Things like this make me phrase the following question (which I never see answered): if crypto is so incredibly hard - N.B.: I do think it actually is very hard

Things like this make me phrase the following question (which I never see answered): if crypto is so incredibly hard - N.B.: I do think it actually is very hard myself - what is a run-off-the-mill developer to do? Shouldn't I even try to build a secure application using what is out there, even if it has possible attack vectors? If I get it 98% right, isn't this a win for users already?