Frequently presented arguments: Worrying about things like security would adversely impact your time-to-market. Security isn't a feature---it has to be baked

Frequently presented arguments: Worrying about things like security would adversely impact your time-to-market. Security isn't a feature---it has to be baked in from the ground floor and isn't apparent to the end user except as a annoyance. Security is a difficult problem that requires at least some minimum of knowledge and experience---knowledge and experience that are unrelated to the device or the development of its new features. There is no financial or professional upside to paying for security, and no financial downside to not doing so. Security is always regarded as a magic-bullet topic; there must be some magic pixie dust to sprinkle on the device to make security problems disappear. Like firewalls, VPNs, and encryption. Security problems have two advantages. First, they are rather rare and something that happens to other people. Second, they are easy to push off onto the end user: "Well, har, har, you wouldn't have this problem if you had just..." The devices themselves are regarded in black-or-white terms: either a coffeemaker with multiple processors is the best thing since Attila the Hun invented the pillage, or the whole idea is more idiotic than selling a fish a bicycle. No one is interested in a middleground, cost-benefit analysis. Yes, many of these put the responsibility for the (lack of) security of devices on the engineers and developers. That's why we get paid the big bucks.