Meh, I think the title of the article is misplaced.

Developers don't need to care about threat models. Developers need to care about the attack surface their applications expose.

This article feels a lot more like it's directed at engineering managers than it does at individual developers.

It sort of pretends that there aren't best practices and that we all have to just invent shit from scratch every time we do anything. We don't have to do that.

If we all just considered OWASP top 10 and mitigated those, almost everything Fowler is suggesting here would be irrelevant.

Most people are going to get threat modeling wrong. Just follow the fucking rules. They aren't that hard. Just inconvenient if you are in a hurry.