> If you are a business, then definitely yes. But the average self-taught developer will not have the resources available to hire a security consultant.

True. You don't need to hire consultants to perform a security audit. Ask HN and Security Stack Exchange are good free alternatives to get critiques on your approach.