We got a SOC2 cert in our bootstrapped small saas company. Then we hid the report behind Enterprise subscriptions because it takes too much time, effort and money to obtain and maintain it.

We did not get certified because we wanted it, we did because the enterprise scale customers forced us to. Due to their internal bureaucracy.