Giving devs the green light to go crazy is also a recipe for disaster. Devs don't necessarily understand everything going on within a organization or even have a grasp on the security controls in place. In the last six months, I have experienced devs publishing secrets to open buckets, using insecure algorithms for creating customer and session ids, go to production with 3rd party vulnerable code, attempt to bypass a waf, attempt to bypass penetration testing and the list goes on. All of these things were done by developers with at least 4 years of "experience". Saying NO is sometimes the best way to save your business and brand from ending up on krebs as the latest breach.