If you, as a developer, jump ship to the new shiney without understanding the security story then it is your fault, irregardless of what promises were levied by

If you, as a developer, jump ship to the new shiney without understanding the security story then it is your fault, irregardless of what promises were levied by your new tool. That doesn't mean that bad defaults are fine, as part of the community we should all be fixing these, but knowing about these things are part of the job and you should not absolve the framework jumpers of their responsibilities. More importantly, companies should pick their technical leaders better. That they don't is often why they end up in a mess.