SaaS companies want to charge a lower price to price-sensitive customers like bootstrapping startups, and a higher price to price-insensitive customers like big corporations; and they need some way to draw the line. And the moment you've got time to waste on things like SOC2 that drive you towards SSO - you are a price-insensitive organisation.