OK, that's fine. Not everyone has to know everything.

So why aren't their employers investing in educating their devs & PMs about security? (rhetorical - we all know why)