> security incidents happen all the time

Do they have to?

Isn't this notion making developers sloppy?