Like all things, different niches attract different people. There's a market for cyber security and if you're well-versed and highly qualified, you could certainly make as much, if not more, than a software developer. Of course, we could get into the cynicism of how corporations view cyber security professionals (i.e. as someone to blame when something goes wrong, despite not listening to their cyber security employees because it would hurt their quarterly earnings), but that's tangential.

You can do both in exploit development and there's some really good money [1] if you come up with something very dangerous. However it's a very hard field to break into unless you have tons of programming experience with system-level languages like C/C++, x86, ARM (extremely relevant today since virtually everyone trusts their privacy to their mobile devices).

[1] https://zerodium.com/program.html

Security is more interesting work than development for many. Also, money and job security. At least from my experience, and intermediate Security Analyst will make about the same as a senior developer (Mid West market), and there does appear to be a much lower salary cap for developers than security engineers. In addition, Security seems to have far more available positions right now, as many corps are trying to 'catch up' and finally admit they need security.