>Each team (pm/test/dev) were responsible for building the threat model themselves, but the threat model was reviewed by another security team.

That still happens.

>Is annual security training still a thing?

Yes it is.