Ask HN: Why has security training for software engineers not evolved?

I feel the state of the art in terms of security training hasn't changed over the years and the current training material is not effective. What are we doing wrong and how can we fix it?