Yes, it is. Full time employees usually work on their laptops, which can be stolen or hacked especially when they're outside work. Ultimately, people and culture are usually the weakest links in security.
As the author of the OP, I must say this is very well put. Part of the problem is that there is no fixed 'role' for the person with the 'deep business expertise and shallow but meaningful data science expertise'. In my experience, it could be a bunch of different people. When I was in a network security startup, this expert would typically be a malware analyst. In other companies, depending on the project, it could be someone from Product, Sales or Marketing. Similar to designers, a data scientist is expected to figure out who the main stakeholders are and get them engaged in the process, instead of the business stakeholder being part of the data science team per se.
Agree with this. In fact, Lead Data Scientist roles often become de facto PM roles, where the LDS basically spends their time prioritizing the important research questions DS has to solve based on customer and business needs.
I've been hearing from multiple people that this is a gap that's really hard to fill right now -- PMs who can work with heavy DS and AI products. It's much easier to train experienced data scientists to be PMs than the other way round.