See this is what worries me. Software developers have long left security and privacy concerns to IT. But they can't produce force shields that magically protect apps or the data they can access. Developers will eventually have to take action and the longer that can is kicked, the more painful it will be.

The article is correct as far as it goes, but really falls under the umbrella of IT compliance.

And implementing PCI, SOC2, etc. along with GDPR, etc. is a massive and ongoing project.