Most investors aren't demanding cybersecurity preparedness from startups, but founders should still be worried about the risks.