Small businesses are not targeted because they are valuable. They are targeted because they are reachable.
Five protections cover most of the real risk: multi-factor authentication everywhere, managed backups you have actually restored from, patched endpoints, a password manager, and a written answer to "who do I call".
None of these require a security team. All of them require someone to own them.