I think the infosec community is the biggest barrier to improving security.

Security is like a bug light for ambitious idiots now. In large companies the function has been staffed up as a separate vertical with lots of CISSPs and other alphabet soup people who run around chasing nonsense and reporting how valuable they are.

Security expertise needs to be embedded in projects and programs so that leadership with domain knowledge can make smart decisions.