I have a theory that this heavily relates to the feedback loops and signals in play. New features are positively observable and their impact is observable from release onwards.

When defending against unknown unknowns, security is unobservable. It's observable only in its absence. All that's left are heuristics and synthetic signals like pentesting.

I wrote a multi-thousand word essay on the topic, but for an internal audience. I don't know if I could properly share it.

My own speculation is that we got here in this industry though a complete absence of liability. Bugs are not a big deal, they are _expected_ now.

The only counter example I know of is Knuth's bug reward system.