And "a very limited number" may mean "though we pretend to be a big company, we have a limited number of customers and while they all pay licence fees, most are not actually using the product in production."

Ivanti isn't exactly a small company. It's products are used in fair amount of the F100's out there so any risk on their part can have an outsized influence.

That's why you hire a CSO: Chief Scapegoat Officer.

You pay them a million per year, and fire them when a breach happens.

Way cheaper than improving security.