I'd argue that if there was a demand for software correctness - motivated by, say, legislation applying some baseline standards on such in sensitive application

I'd argue that if there was a demand for software correctness - motivated by, say, legislation applying some baseline standards on such in sensitive applications like money processing - we'd have a lot more smart and experienced engineers focusing on security in particular. The way things are now is because we as an industry have decided that "move fast and break things" is acceptable, and our culture reflects that. So we need to change the culture.