You assume that the business is about developing software and will have a public facing API.
That's a very narrow perspective. The vast majority of businesses aren't this. Even a plumber who types up offers and invoices on a computer is subject to all of this mess.
> Even a plumber who types up offers and invoices on a computer is subject to all of this mess.
Yeah and that plumber has 1000s of customer names, addresses, phone numbers, mail addresses, in Europe maybe even SEPA Direct Debit data.
Not funny if that kind of stuff leaks, especially not if you're, say, a person with a public register block due to domestic violence or whatever (basically, one step before witness protection that gives you a whole new identity).