The reasoning is, I guess, that it's usually not engineers that introduce serious problems and vulnerabilities to software, but management and sales introducing unreasonable demands and not caring about the product any more than how much money it brings.

> How would they know whether the bridge is designed badly?

It's their responsibility. If it's not possible for them to comprehend the design and execution thoroughly enough, they'd better make sure they had someone check it whom they can trust to understand it. Like ancient builders, who didn't lay every stone themselves, but were still responsible for the outcome.

Perhaps our standards for responsibility of leaders are a little low these days.