That's less of a problem with building to spec (security is not a "spec") but instead with employees who are not familiar with keeping data safe, companies that

That's less of a problem with building to spec (security is not a "spec") but instead with employees who are not familiar with keeping data safe, companies that give too much access to regular developers (e.g. Uber, I can attest), or engineers who are underqualified but charming or otherwise smooth talkers that worm their way into security-related positions when they have little to no experience or knowledge in that area.