The uptake is both have these problems and to be extremely wary of either either until they concretely show they can be trusted again. Having worked in several different software shops my experience has been software culture and security culture are extremely hard to change. It absolutely requires major restructuring in people and often major investments in reworking of software with the right priorities.

I won't be holding my breath. The most common solution (practically the only solution I've ever seen happen) is to put bandaids on and just keep reworking the big ball of mud.