Security. Every time.
A clumsy mobile checkout costs you sales you can win back tomorrow. A payment page without a valid certificate, or a form posting customer details in the clear, costs you something you can't buy back — the assumption that you're safe to deal with.
The order matters because budgets are finite. Fix what can't be undone, then fix what can.