Profit/cost center is kind of a false dichotomy in some places. At the least, it lacks nuance. If you sell software or services that require privileged access, security tends to be valued more highly than a checkbox.

Generally companies that have been burned in the past for not having a good security team and have sufficient organizational memory will continue to value security efforts moving forward.

I was working for a hospital, then they converted us to work for a company that sells our services to hospitals, then they outsourced 300 of us to offshore including me.