Who is supposed to understand this then if not everybody? If you think of this as a "security focused engineer" problem then you've already lost.

If an engineer doesn't understand how to write secure software then they will continue to write un-secure software and there will be leaks and compromises. You're just externalizing risk and costs to your customers.