I don't agree with your point regarding most sites don't need pro-level security. I have more than 7+ years of SDE experience and I have witnessed that the level of cyber attack is increasing day by day. Even well-establisted companies are not safe today in terms of security. Thanks.