I'm not sure what your experience is, but mine is over multiple decades over multiple companies over multiple continents, and in general, corporate management, project management, and business analysts are not concerned about security.

Instead, they are interested in delivering buttons, fields, and streamlined workflows. Technical debt and library upgrades? Os upgrades? Forget about it. They need to deliver value back to the business in terms of faster business processes.

Only when the business is hacked or they fail compliance does the business leadership start to care.

Blaming the people with the hands on the tools is not fair when the business will not give the resources to do their work properly.