In my roughly 10 years of experience at megacorps, security related work towards products is generally treated like a compliance matter for the company, for better or worse. My experience in summary:

Testing: the security team run a few ad hoc tests, or only run the app team's automated security tests, or not at all.

Models: Once I built a threat model interactively with a security team member, but most times they'd ask the app team to put it together and send it to them. Usually would be reviewed with a few questions.

Paperwork: most of the is spent filling out forms, looking at automated tool results and addressing as needed, providing spreadsheets with new features or changes and their security requirements.

Code analysis: I don't think I've ever had a security team member read source code. Maybe I'm not remembering, but I genuinely can't think of one. I would love to have this happen though.

So, I guess I haven't had a good experience with security teams overall. I don't generally attribute that to the team itself though. They're often way over taxed and trying to oversee upwards of 10 projects with tons of reporting requirements and deadlines for releases. There's really no way in their structure or funding they _could_ do more than this. It's kinda amazing they even get this much stuff done now that I think about it! But yeah, I've never had an experience like you describe.