They help enforce regulations and prevent random programmers from doing something stupid.
IN the case of openSSL. Even though we all collectively know how important security is for the Internet in general, it would be hard to convince investors to fund something that is a collective good with long term potential.
Right now except for EFF, no one is voicing the concern about encryption. And it's all programmers collective fault for letting this happen.
Right now there are major problems surrounding IT, while we are forced to work on marginalized things. Meanwhile foreign private contractors get the govt deal since they are the "cheapest". Remember healthcare.gov, how does a country with the best programmers make such blunders ??
It will be expensive to increase training, provide certifications for security and create a open industry around security. But cyber security is as much or more important than other forms of defence. The reason for myopia is because its not as cool. Imagine if some spy infiltrated and stole physical copy of all the records of Govt personnel ??
Can a price be put on it ?
The software world consists almost exclusively of at will employees and 1099 contractors. They ship whatever slop management demands, and have no recourse.
It's embarrassing that we let this shit happen. this is why I think cs needs some form of labour union ( like the brotherhood of teamster, I didn't know truck drivers got better wage than half of us ) the wages keep on dropping and we have no say in where to divert investment.