Compliance is not security, but "security" is too nebulous of a term to actually implement effectively, so companies use the specific regulations and standards to have a measurable target to strive for.
In my company, we have additional security measures and guardrails on top of the bare minimum legally required, but most companies indeed see security as a cost center and decide not to invest until it's too late.
Like some other people point out: Invitation-only means trolls are less likely to show up. But the higher end of quality is not significantly better than HN.
If anything, it might be worse.
My experience with the moderation there is that some people post clear self-promotion articles, but when I attempted to post my things, I get told that this content is not welcome on the site. Why my content is not welcome and other people's self-promotional articles are I don't quite understand, but it is obvious they don't need me on the website.
The only people who still use XMPP in a significant capacity are the likes of Nintendo (for the Switch push notifications system) and it is pretty out of reach for any average citizen.
XMPP as a protocol for engineering and science is fantastic. As a set of standards it's well designed. Performant, flexible, and powerful. As a general, average Joe software however it fucking sucks big time. And it is precisely this flexibility that makes it suck. It's not just flexible, it's a mess. And mobile support in 2021 is atrocious.
There's a reason why Telegram's very shitty protocol is vastly more popular for average Joes than XMPP ever was.
XMPP was designed by engineers, for engineers. Which is good for this very specific set of engineering problems and essentially useless for everyone else.
Want secure communication? Use Signal, Threema, hell even Telegram is more secure in its default canonical protocol implementations than XMPP. And stop beating the dead horse XMPP is.
In my company, we have additional security measures and guardrails on top of the bare minimum legally required, but most companies indeed see security as a cost center and decide not to invest until it's too late.