Software developers tend to assume that any domain they create for is already so well-established that there’s a single web page on the internet that will explain how to do eveything.

For example, in physics it’s laws of physics. You can sometimes get away with reading an article on wikipedia and it’s probably going to tell you how things are today and a decade in the future.

For security it’s special cases. Being, for example: that certain hash functions will loose on their entropic properties if applied twice. This changes almost every year - and someone needs to keep their docs up to date so that you could know that.

The issue is that security is incredibly contemporary in nature; while laws of physics most developers deal with haven’t changed for at least half a century.