Unfortunately, it's somewhat unfair to always blame the non-engineering folks. Many times is other engineering domains that run counter to good security. In my experience, cost or schedule are the leading factors but sometimes engineers want to push for certain features that are not compatible with good safety or security practices.