Essential security practices (not advanced PT skills) should be basic software quality concerns. Full stop. "But it works" is not an excuse e.g. for doing sql queries without proper parameter binding.