In addition to that, security should probably be a consideration at the design phase of any feature or product. As in, an internal team should be vetting design

In addition to that, security should probably be a consideration at the design phase of any feature or product. As in, an internal team should be vetting design and critical areas of the code itself. But the culture there only cares about "partner requirements". Security, tech debt, UX are simply glossed over.