I think this has a lot to do with certain developers not knowing much about security and not wanting to go down the rabbit hole of potential threats and concerns. In my experience a lot of people from project managers to developers would just rather ignore things they don't really understand (especially if it's not causing an immediate problem).

Especially true because customers rarely want to pay for it and when there are issues you just sweep them under the rug and move on. Developers are the last people we should look to blame / change if we want better security.

I did not mean to suggest that it is exclusively or even primarily a developer problem, though developers do also have a role, for example in following best practices.

Agreed, but a lot of automatic security scanning is really heavy on false positives, which can be extra obnoxious for people.