Depending on how you define this word (actual vs perceptual security) we would adjust the type of conversation accordingly.
A lot of "security" is theatrical crap that skilled developers don't have patience for.
Infosec team ran regular vulnerability scans and flagged our Go code as having a violation of some .net specific bug. They requested we fix it. Literally nothing to fix and no teams ran .net anything.
Another time, the security team discovered a bug in some open source MTA (mail transfer agent; email sending) and multiple times insisted we implement a fix. We didn't use that software. Worse than that, our company only existed because we wrote our own MTA, it was our core service and reason for existing.
At one point, a knowledgeable security expert was worth something. Now it seems to be checkbox driven.
I have heard similar stories from other people I know.
There is unfortunately for business an acute shortage of good security people. This works well for me of course, as I find myself in demand :)
When you have received a number of invalid URLs from an ip address then you shadow ban the ip address by sending "404 not found" back for ALL following requests from that specific ip address no matter if it requests a valid URL.
Now all the security checking is skipped because simplistic security testing looks like "yet another hacker".
The same kind of thing happens to certain managers and scrum masters that don’t get their hands dirty from time to time and have no feeling for what is bogging down the product.