That number sounds like someone either cherry-picked a really intense week or misunderstood what they were reading - half a mil daily would be astronomical and would've been all over tech news in a way that stuck around.
The thing is, most companies do spend on security and incident response, it's just usually not announced with a specific daily dollar amount because that invites way too much scrutiny and speculation. If there's a real breach affecting user data, that's when you'd see actual reporting and notification requirements kick in. The bigger issue is whether OpenAI's being transparent when something actually goes wrong - that matters more than whatever they're spending on routine security work.