The customer is paying for it either way. Do you want liability insurance on your critical software project? Sure! But it'll just balloon the already ridiculous

The customer is paying for it either way. Do you want liability insurance on your critical software project? Sure! But it'll just balloon the already ridiculous costs and a fraction of that money will maybe be spent on educating the engineers and ensuring the system is secure. On an individual level, expect to see this: "Our records indicate that you have previously committed (a minor, unrelated change) to a software repository that was later exploited, unfortunately we are not able to offer you a position at this time (due to insurance reasons)"