Sqreen (YC W18) is one counterexample, but they came into YC at a later stage of maturity than your average YC company.
As to why there aren't many others, that's a great question. It's a hard space to get started in, since security is mission critical for essentially everyone, so that likely doesn't help matters. There's a lot more that needs to go into a viable MVP in cybersecurity than in other areas as well, since there's much less room for error and jank.
Those reasons likely contribute, but none of them are hard blockers.