And unfortunately, their value is often directly proportional to the amount of workload they add to the productive segments. People wonder why security teams are the first to be cut during hard times, but this is basically why. That said, I can see both sides of it, security is obviously of great importance. But there just has to be a better way, perhaps some categorization of threat models cross referenced against the CVEs/etc.

> security is obviously of great importance.

It is. But the thing is, those corporate infosec folks I'm talking don't actually improve security. It's the same as with many audits.

Shoving out endless amounts of broken trash has negative value to society, even if it makes the company money hand over fist.