In my experience certificates like this are considered pretty useless by most software engineers. Anybody can do a certificate and have their hand held all the way through it. Real world experience in much more valued. Also software dev is both an applied skill and a fast developing field too in which not everybody agrees on the right way to do things, so its hard for universities to keep up with the changing times. Plus whatever job you get after university will probably require you to learn a ton of new stuff anyway. Basically I don't believe that software engineering is a field in which you can go off to study for a year and then be considered better at your job because of it. (This could be different if you were to study a more specific subset of computer science like security, computer graphics, machine learning etc.)

That said you've been a developer for three years so are in a pretty good position to try moving to a company which does more advanced stuff and further your career. This of course has the added benefit that you don't have to make any financial sacrifices, in fact you will probably get paid more by doing this.

Finally you mentioned getting into Appsec, if you want to specialise in a field like this then I would highly recommend that. As I said earlier spending time to specialise in a field like this would be worth while, you could do a degree or do a certification like the OSCP (unlike software dev, certifications in info sec are actually valued if you do the right ones). This is what I'm currently doing myself after 5 years as a developer now specialising in security.