Security issues, like other emergent system properties, can arise at any layer of the stack.

While code level issues should absolutely be a focus in the SDLC, it's common to find security issues crop up from:

* Hardware, kernel, OS, package, and library vulnerabilities

* Component integration / API contract misunderstandings

* Transitive trust between services and third parties

* Accumulation of access over time

* Demos, hotfixes, and workarounds that are somehow now mission critical