Its a tough gig, focusing on making meaningful changes to improve the security of a process without being in the weeds for individual issues.

This is why the decrees are made, I guess it strongly depends on the tone of the message and the messenger. A little bit of social engineering of engineers goes a long way.