I'll say it again: no one cares about security.

First, no one is ever punished for having security breaches: companies outsource security specifically to avoid responsibility (using contract law to transfer risk). Second, the MBA mentality has infected software development such that first to market and feature velocity trumps all: if I can download a package or have an LLM write my code so much the faster than me writing it.

Security is fucked because shareholders want it that way. Change the incentives to make security matter if you want something different.