If a security researcher comes from developer and/or system administrator background then he/she uses his/her experiences and habits to guess where to look first.

That's why it is always suggested to start from point zero to be a solid security researcher.