That doesn't put the primary fault onto devs though. There is a significant amount of pressure to actually build all these stupid systems coming from multiple fronts (e.g. people who believe it is more secure, business who demand certain features). Surely primary responsibility goes to the person who demands the feature. If one developer refuses, they can find another developer without too much difficulty. It would require most developers to refuse, whereas it only requires a few business owners to make other choices.

(Senior Developers could probably respond "here's some better ways". But Junior devs often hardly know their own name, let alone what better alternatives there are to this security theatre.)