I've got 5 years as a full-stack Vue.js/.NET Core/AWS developer and 2 years as penetration tester. I didn't know we were this rare, but it's nice to hear.
I don't think you're drawing the right conclusion.
It isn't that enough people arn't wildy smart enough/don't have the mental capacity to be a full-stack developer AND a penetration tester simultaneously.
It's that it just don't make sense to enough of these wildy smart people to take on what's essentially three jobs, that when done well, individually consume 30+ hours a week each.
Businesses that hire these frankenstien's monster as employees instead of contractors just don't have a clue.
It's also extremely likely these frankenstien's monsters will burn themselves out as employees essentially juggling three jobs as a salaried flat rate employee.
The only scenario in which being this frankenstien's monster make sense is to bootstrap a consultancy as a founder or a contractor, sign up enough clients and scale out by hiring specialist employees.
The only reason why these frankenstien's monsters happen (outside being a founder or a contractor and I am talking exclusively about employees here) is that employee started off as one type (full-stack developer OR a penetration tester), failed to find employment and cross trained into the other, where they found employment.
For example, without knowing any details, it's likely the full-stack developer AND a penetration tester started off as a penetration tester, failed to find employment and cross trained into full-stack developer. Of course, devil lies in the details, so if the full-stack developer failed to find employment as one but noticed significant demand for penetration testing, they could very well have become a penetration tester.
Empirically a penetration tester doesn't have either time or energy to be an effective full-stack developer or vice versa, especially outside a founder or a contractor role in a bootstrap stage.