Cyber insurance for fintech startups often has to be underwritten before a formal security audit exists, which changes how carriers evaluate risk.