Then when someone else finds out a few months later, suddenly alarm bells start ringing, and everyone up to the CTO is called into an emergency meeting because there is a huge security vulnerability.
Yeah, no shit.
sigh
I've found this also happens for good things. "I've found this amazing thing that will save us millions of $". "It'll never work and as soon as I understand what you are talking about, I'll tell you why".
What's absolutely horrible about this is that I've caught myself having the same attitude! I've been trying to stop myself from doing it, but man is it difficult. The default, "My coworkers are brilliant" point of view is just so contrary to my cultural upbringing ;-)
This hits so close to home.
And yes, it requires a lot of mental energy to avoid falling for the same trap.
It's not just cultural upbringing. It's difficult to really realize that the intelligence/competency distribution at work is vastly different than in the rest of your life and all those years before work. Especially if you work for a highly selective employer in a high-skill job market. We learn from experience afterall and encounter a lot of incompetency throughout life. We also tend to weight negate experiences much higher than expected ones.
I still catch myself being happy and surprised, if I encounter someone competent and usually expect incompetency. It's rude and on average probably wrong, but trained from experience.
I guess the "responsible disclosure" culture is partly to blame here. If you get 90+ days to fix any vulnerability, then software that ships with (internally) known security issues is much more viable.
When other people or audit start noticing too, the potential for fines and PR disaster will go up orders of magnitude. Resolutions that were previously impossible can be evaluated again.
Before somebody says that it is a trivial fix to turn on a light. It is not. That would have to be retrofitted in the few existing planes and future planes, starting by notifying clients and regulators. A long and costly fix, creating a long paper trail of something being wrong.
Seniority in a position (imo) is the soft skills, and communication chops to either present a better argument, make sure there are written email statements of it not being a problem, or not take no for an answer.
It's easy to throw up your arms and say, well I said it in some meeting.