it's actually the tip of the ice burg. Given that there is no standard of care and that there is no barrier to entry to being a software developer there are a lot of things that are poorly done in this industry. Security is just one of them. With that being said I've seen a lot of secruity people go overboard with security and not take the other factors into account. IE: security people trying to prevent the CEO from having acccess to resources, or adding in policies that cost more to implement than the cost of the threat etc..