Hacker News Reader

Simple answer: There aren't any incentives in place to reward it in most professional contexts.

Yep.

Good security: no one notices (unless you do activism for it in your company!)

Bad security: someone notices, but it's never an individual dev's fault