Regarding your first point about security, I see the opposite on a weekly basis. Devs, especially in startups, make secure technology decisions, but in a very narrow and entirely technical scope that essentially encompasses "their world". Once induced to see the larger picture either due to a compromised system, or table top exercises that include the rest of the business, they and leadership start to realize they've had a false sense of security.