You'd be surprised how many engineers don't understand security. A few years ago I complained to the DD-WRT developers that they need to serve up with firmware

You'd be surprised how many engineers don't understand security. A few years ago I complained to the DD-WRT developers that they need to serve up with firmware images on HTTPS (They were serving them up on HTTP). Their images are not cryptographically signed and they didn't publish hashes so at the very least they could try to secure the transport and use HTTPS. My request was rejected and they were confused as to why HTTPS was necessary as "it's not like we're doing online banking".