Another issue is lack of education/training/awareness among developers. A BS in CS has maybe one class on security, and then maybe employees have a yearly hour

Another issue is lack of education/training/awareness among developers. A BS in CS has maybe one class on security, and then maybe employees have a yearly hour-long seminar on security to remind them to think about security. That isn't enough. And the security team and engineers that put the effort into learning more about security and privacy often aren't enough to guard against every possible problem.