For companies that have programmers that work great, but aren't security experts, it's time to hire security experts.
Suggesting that all the work the programmers did is worthless because they aren't security experts is seeing the world as black and white. It's gray my friend.
"Okay I put together this prototype and it's working. I should check it over for SQL injection spots and---"
"StoptalkingnotimeforthatSHIPITNOW!"
Yeah, there are lots of mechanics out there who do a fine job. They are just clueless about breaks ;)
Stupid analogy aside: If you as a programmer who develops stuff for production are not aware of rules like "NEVER EVER FUCKING TRUST ANY USER INPUT" then you're just wrong for the job.
Some are programmers who manage the User Database. They deal with all user accounts data. But they aren't the same guys who are responsible for server security.
I'm talking Enterprise Apps that support tens of thousands of users.