As security tester I don't understand how hard is most basic authorization and access control be in systems. Do developers actually need my time to check if you

As security tester I don't understand how hard is most basic authorization and access control be in systems. Do developers actually need my time to check if you can access something either unauthenticated or with different user. And then update something that I shouldn't even be able to... I admit what request updates is step forward, but still something that should be automatically thought about. Or is it just move fast and leave things broken mindset?