I think Shape Security qualifies for this list. They raised $100M before having a customer, seemed to die, quietly got adopted by a large pool of F50 companies, and exited to F5 for a $1B valuation. That’s a big chunk of change for a security play, especially back in 2019.
Their moat ended up being two fold. One, they were the only tech stack that could handle the scale needed back then. Two, they had a crazy culture of never letting adversaries win and would push daily updates to keep attackers off their customers. Both took a long time to iterate and build towards and nobody thought it was cool while they worked through it.