Security is often implementation dependent, meaning: you need to understand exactly how your software does what it does before you can understand how to do that

Security is often implementation dependent, meaning: you need to understand exactly how your software does what it does before you can understand how to do that securely. For non-trivial software, this almost always means you will have to build an implementation first, before thinking about how to add security. Overall, I think security has gotten much better, but for complex software there are always going to be challenges.