There's insecure code, and then there's a company that will threaten to fire you if you don't run insecure internal code on their corpnet. Hacked-together internal test app running on an alpha version of .NET that was expected to run on my machine 24x7 that (as one example) wrote to %PROGRAM_FILES, requiring that it be run as admin. Told my manager, "I'm not running that, it's a threat to my machine and the corpnet." "Run it or else", I was told. Not that it mattered, I was probably one of only three people in Visual Studio that didn't run their machines as admin.

This was after the Gates and Valentine emails on how MSFT was going to start taking security seriously. The point is not that I had an asshole for a manager, but that even though MSFT said "security", the boots on the ground often took as just another barrier to their greatest that was to be ignored as much as possible, and implemented just enough to shut up the gatekeepers.