Compliance is not security, but "security" is too nebulous of a term to actually implement effectively, so companies use the specific regulations and standards to have a measurable target to strive for.
In my company, we have additional security measures and guardrails on top of the bare minimum legally required, but most companies indeed see security as a cost center and decide not to invest until it's too late.
Like some other people point out: Invitation-only means trolls are less likely to show up. But the higher end of quality is not significantly better than HN.
If anything, it might be worse.
My experience with the moderation there is that some people post clear self-promotion articles, but when I attempted to post my things, I get told that this content is not welcome on the site. Why my content is not welcome and other people's self-promotional articles are I don't quite understand, but it is obvious they don't need me on the website.
And Apple Pay is much harder to trace (except for Apple and your bank I guess?) than just using a plastic static card.
I can't count the amount of times I've lost or been robbed physical bills. Never once have money siphoned out of my online bank. I don't use cash anymore, I'm all digital, and still use a VPN to watch porn.
Turns out different people have different threat models. My threat model includes my neighbour, my ISP (to a certain extent), my employer (again, to a certain extent), private companies like Google or Facebook, burglars, thieves, and scammers.
It doesn't include the NSA, the government, the NSO group, banks, or North Korean government-sponsored hackers. If you think you can defend yourself against the NSA, lol. Good luck.
I'm also pissed off when I see HN people seeing 200k or 300k salaries as "too low". Jesus, Americans are millionaires, what the hell?!
I'll tell you the reason: they do this because they can. It's not talent, it's competition. Who in EU is going to give you even 80k as a junior? Nobody. So why bother offering 300k or even 150k when people will take the tole for 60 or 70k?
Inb4 "but housing is more affordable!"
Whatever. That's not related to the employer. It's simply racist. "You earn less because you're European" is the truth. It's not because cost of living is lower (although it's related) but it's just a matter of employers being able to get away with shitty pay.
The only people who still use XMPP in a significant capacity are the likes of Nintendo (for the Switch push notifications system) and it is pretty out of reach for any average citizen.
XMPP as a protocol for engineering and science is fantastic. As a set of standards it's well designed. Performant, flexible, and powerful. As a general, average Joe software however it fucking sucks big time. And it is precisely this flexibility that makes it suck. It's not just flexible, it's a mess. And mobile support in 2021 is atrocious.
There's a reason why Telegram's very shitty protocol is vastly more popular for average Joes than XMPP ever was.
XMPP was designed by engineers, for engineers. Which is good for this very specific set of engineering problems and essentially useless for everyone else.
Want secure communication? Use Signal, Threema, hell even Telegram is more secure in its default canonical protocol implementations than XMPP. And stop beating the dead horse XMPP is.
In my company, we have additional security measures and guardrails on top of the bare minimum legally required, but most companies indeed see security as a cost center and decide not to invest until it's too late.