It isn't about money or size as such, it is more about exposure and careful design.
Good practice for storing user authentication details includes doing a one-way hash of a users password and only storing that. There are many ways to do that hashing process but not all of them are especially secure. It also includes storing the authentication details inside a more secure area of your network to reduce the potential for attackers to be able to grab a copy of the database (giving them time to work on decrypting it offline).
Ill thought-out designs create serious weaknesses in complex security giving attackers an easier time of getting in and getting hold of critical data.
Security conscious enterprises also tend to have more complex security architectures built up in layers with additional tools such as Intrusion Protection and Data Loss Prevention services and have some form of security operations that monitor activities across the IT estate.
That all costs $$$ of course and enterprises working on narrow margins might skimp on such things.
Finally, you get the "Innovation" problem. Where you get an organisation that is primarily focussed on innovation such as a startup with a specific idea to sell, it is all too common to find that common sense never makes it into planning and operations!
Google managed to find that right combination of innovation, planning and operations that has made them very successful. They have much to offer but actually are far from a shining light in terms of customer security but that is probably a different question.