Because 'security' is fractal in nature and affects every little detail down to the hardware level (where even our lord and saviour Rust cannot help). No matter

Because 'security' is fractal in nature and affects every little detail down to the hardware level (where even our lord and saviour Rust cannot help). No matter how secure your code or hardware is, there will always be an exploit waiting to be discovered. When this inevitably happens the security 'extremists' come out of their holes and yell 'I told you so', which is not exactly helping the cause ;) Meanwhile devs need to prioritise time spent on security versus product features and actually getting shit done. TL;DR: I bet most devs do care about security, but it's just one aspect to prioritize against other goals, and it's a task that can never be fully completed, not pro-actively without specific threats at least. You can never check that "this project is now secure against random attacks" checkbox.