They're also a category where security is inherently a user-visible feature of their products (and as such, it _should_ be easier to justify security engineers)

I thought that there was a non zero probability that they are "hacking" themselves, simply taking customers money and inventing excuses for it.