You might be right regarding startups where developers must wear many hats but I wouldn't agree it applies to these "vulnerable" industries as a whole. E.g. my

You might be right regarding startups where developers must wear many hats but I wouldn't agree it applies to these "vulnerable" industries as a whole. E.g. my experience in one of the major banks was exactly the opposite. There was a separate security team who created authorization and authentication libraries for FE and BE(extensions of Spring Security, Angular/React etc.), forbade other developers from coming up with any custom security solutions and constantly performed audits of the applications and infrastructure. I didn't like it but it worked flawlessly for the bank.