You present valuable arguments, but in this environment shipping is more important than creating an appsec team or bug bounty program as a solo developer. I'm sure you understand :)
Is it? Isn't "not losing people's personal health data to a breach" more important than shipping?