The problem might be 'Hopeless Engineers' as you term it. I don't think certifications can correct people who do it just to get a job. The general way of passing certification by the masses is to get dumps of previous years questions from the internet or friends. Read the the book, mug it up as much as you can. Read the questions and clear the certification.

This is bad, very bad in fact. Its amazing things like this happen from time to time, even things like storing passwords in plain text. This goes on to show only two things, either utter negligence and lack of seriousness on the part of designers or just that they are not aware of even the very basics of computer security.

Engineers passing out of colleges with just degrees and some out side memorized bookish knowledge. Copy pasting snippets of code from the internet when they are asked to write code. Just doing minimal feature compliance tests. Lack of idea of seriousness of jobs they are doing. Failure to understand the overall architecture. And hopping jobs when this sort of things happen.

A ideal approach to computer science security is to have professionals obtain licenses. All people working on security must obtain a license. And failing on things like this must attract penalties and punishments.