IT security people also have different incentives. If developers got bonuses for uptime while being compliant with all security policy requirements, while security and operations got bonuses based on features reliably delivered, you would have different results.