> Do you have any evidence of that claim?

I'm not going to link to specific github issues but I've seen enough people dropping "vulnerabilities" and yelling at the developers. (I'm pretty sure you know what I'm talking about.) This often gets the developers worked out and gives security people a bad rap. It's a lose-lose situation imo. People need to learn empathy and stop blaming developers.

Of course there are companies that need to be shamed, and that will repeatedly act shady, but too many people use this to excuse their behavior in general.