Security comes last, if at all. This was back when I was a junior dev, but I had to demo how an unprivileged user could delete every user in our system before

Security comes last, if at all. This was back when I was a junior dev, but I had to demo how an unprivileged user could delete every user in our system before I could work fix that section of code without getting fussed at for trying to discuss something unimportant. Even then the immediate response was, well we have a nightly backup so we're fine.