Jup.
To summarize, engineers mostly don't live security not because they don't care, on the contrary, but because doing so is the fastest way to sabotage yourself in the workplace and make enemies.
Two of my own examples
1)
A coworker had the task of updating aged signal generators, because we had reported a bug which was then fixed. The signal generators worked without memory, a USB Stick was used as storage memory. As he plugged said USB stick into the work laptop, which he had never touched before, a virus warning popped up.
We decided to do the right thing and tell our IT department about it and ask for further steps..
What followed were ridiculous hostile accusations, threats and pressure by the IT people, instead of a sensible reaction.
2)
We had a safety instruction at work and it was pointed out anyone should follow safety rules and remind colleagues to spread awareness.
Few days later I entered through a security door and two unknown colleagues followed right behind me. As I noticed, I politely asked them to show their access credentials.
I was met with hostility and disgust. Later I learned those two were higher ranged managers, anytime I met one of them later, they remembered and treated me badly, for doing exactly what was asked.
I even went so far and told my supervisor of both instances to "raise awareness" of the reality, but only got shrugs and a blank face.