Because developers don't always consider the security aspect. Not saying this is what he's doing but could also just be due to how complex good software can be

Because developers don't always consider the security aspect. Not saying this is what he's doing but could also just be due to how complex good software can be to write. Their is a reason cybersecurity or UI/UX or product design isn't always left to the developer. The coder write code that fits certain criteria they are given, then someone down the line might QA check it, fuzz inputs or security review the code. How well this is done depends on the product,market, and environment.