Education alone would not help if SWE in many (most?) large companies have no incentives to make software more secure. Even worse - caring about security can make their performance look bad. Companies try to improve security by inflating dedicated security teams which in many cases don't care about an actual product, its code (and infrastructure) but can annoy engineers by arbitrary rules/checklists/policies e. t. c. which IMHO rarely improve product security.

How to create this incentive is an open question but more laws and regulation doesn't look like a good answer to me.