Those things are not mutually exclusive. And the original framing that enterprises "no longer trust their developers and SREs to take care of security" is a bit

Those things are not mutually exclusive. And the original framing that enterprises "no longer trust their developers and SREs to take care of security" is a bit leading as well. Real, practical security is a mixture of dedicated security teams doing in depth analysis and pen testing, developers and SREs building secure solutions and automated tooling that does basic sanity checks.