I guess I'm just skeptical and jaded based on my past experiences.
Since you bring up a security team, it absolutely can be estimated there as well, what other companies have had hacks and what did it cost them? How does that compare to the risk on your product and the damage to the business if you were compromised?
Not to mention a $40k salary difference means you should be providing multiple times that difference in value to the company. Just providing $40k of additional value is a rounding error for most reasonably sized companies, I've worked on projects where two people provided >$1M of ongoing cost savings per year.
Then how does it work? It seems that senior devs should make the same as junior devs if the numbers aren't tied to value.
"The business makes a decision based on what it takes to get what they need and salary can easily vary based on social aspects afterward. The number tells you something, but not everything."
On an individual level that might be true, but that doesn't address it at the aggregate level.
For support roles, their value comes from the costs that they help prevent. A security expert is like insurance, where they provide value by ensuring the company's product has the minimum chance of being exploited as that could damage the business in multiple ways.