Important view. Implies that the gap is that we're making developers responsible for security but without accountability for the consequences of a breach - wher

Important view. Implies that the gap is that we're making developers responsible for security but without accountability for the consequences of a breach - where the people with the accountability in the event of one are shielded from responsibility for mitigation because they've pushed it down the stack to said people who can't actually hold millions of dollars of accountability. The obvious threat scenarios above are examples of things product managers typically don't think about, but developers assume someone must have understood and decided. I'm trying to ascertain if this gap is a broad problem, or just a dark pattern in organizations that could be by design:)