Somewhat true, I'd say that risk-averse is more appropriate than safety-obsessed. For such organizations, being "safety-obsessed" usually means a massive amount of bureaucracy around certain known risks, but such organizations don't tend to be consistently good at finding and addressing unknown risks.