Thinking back to early on in my career, there was one place I worked that was a complete mess, its pertinent because the first time I applied I was rejected immediately because of the lack of degree but the second time they interviewed me and I joined.
A representative example of the mess: They did waterfall and they'd analysed, discussed and dialogued about a "transaction service", they produced beautiful documents and UML. But it was garbage, it wasn't transactional, it slowly wrote to an xml file, in-situ over the course of an hour long workflow and had an unparsable xml file with a handle open for 99.9% of its lifecyle. This was an embedded environment for industry and the reality of power management and pre-smartphone battery tech resulted in crippling "corruption" issues that were obvious at the design phase which I had to fix later on (but even then, I wasn't allowed to radically alter "the design"). I had as much luck convincing them to use sqlite as intermediary and then producing xml at the end, as I did the other guys installing a cert on their server.
What am I describing here exactly? Normalcy bias? Just "bad" devs, idk? I've spent my entire career grappling with senior staff ignoring the valid concerns I raise and end up feeling like I'm the problem because I'm the only one stepping out of line to demand better, with zero support from my peers. Tbf the guy at that place at least admitted later on that "yeah sorry for not taking your advice, I always seem to regret ignoring it about six months later".
Maybe I've just got to do a better job of seeding ideas, so people think the ideas are theirs and accept them better. Maybe give them the ingredients of a very obvious sandwich instead of making it for them. Idk, I just can't help but feel discriminated against somehow because it doesn't make any sense to me to; not installing a cert on a server and rather forcing people to send their creds over clear; being vehemently opposed to using Sqlite (in more than one org!) when its an extremely appropriate option (in embedded or as an MSAccess replacement). Maybe on that http issue I should have followed my first thought and collected and sent that guy his own password to demonstrate the issue.