At some point, "not taking security seriously" is simply negligence. Other fields already have ways of punishing people for negligence (up to and including susp

At some point, "not taking security seriously" is simply negligence. Other fields already have ways of punishing people for negligence (up to and including suspension of licensure and/or prosecution). Why are software developers immune to consequences for not realizing they need to use parameter binding in their SQL statements?