Working in the industry for a while now I've come to the realization that developers in the vast majority of situations are not security engineers, and should not and cannot be trusted to ensure both the software they write and the systems they run are secure in any manner.

Security itself is a set of processes and policies where different teams monitor and ensure compliance with said policies. If security policies get in the way of the software compiling/working developers will disable security (and sometimes for short periods of time this is needed for testing to figure out why something has gone wrong). But it becomes easy and commonplace for developers to turn off the security because it gets in the way of productivity. And that's the problem with security, you don't generally get punished for violating it immediately by an attacker. It can be months or even years before someone downloads your source code and posts it online. You may not notice for months that your database was breached and everyone that you don't want has a list of your customers.