Great post! I really enjoyed reading this, and can deeply relate to this on a personal level having worked in the developer security field for over a decade now (Stormpath -> Okta -> Snyk).

The only thing I have to add is that this same concept applies to just about everything -- it isn't just a cybersecurity industry problem.

- Bad writing keeps Grammarly in business - Developers doing a bad job at confirming to a codebase's style guidelines causes code linters and formatters to stick around pervasively - Bad authentication and authorization practices keeps Okta/Auth0 in business - ... <the list goes on and on>