It's probably also hard to know what a good security audit looks like, unless you grasp basic security in the first place.
I have no idea what the solution is.
I like this plan. Can't wait for my father, who can barely figure out how to attach a picture to an email in AOL's webmail to start poking for XSS and CSRF vulnerabilities on the sites his spam mail links to, and changing his username to "1;DROP TABLE users" everywhere.
We already have a process in place to deal with flaws in products produced by unlicensed entrepreneurs. We just need to extend it to apply to software products and services.
And it's kind of a legalize burglary, so that people will be forced to live in fortified compounds.
If you replaced security with accounting, the above still makes sense! Why do companies pay through the nose to get an accounting audit done right, but much less willing to do so for a security audit?
I say the solution is to put the (legal) responsibility to the company. Once there's financial incentive, it becomes a priority.