I would argue it's more complicated than that. In my experience, especially I started working for some enterprises, the people who make the complex software are also the ones putting in the time and care into security. It's not a causation but there is something to be said about culture.