If you don't get hacked, everything we asked you to do was a waste of time and resource. If you do get hacked, we were incompetent.
Our security team also engages in social engineering - making practices deemed insecure gradually more and more difficult through artificial roadblocks (e.g., adding y/n dialogues to commands that previously had none). Doesn't do a whole lot to build goodwill
One good way to communicate and discuss security requirements is using threat models. A nice data flow diagram or architecture diagram showing the threat actor and attack vector helps a lot, along with any controls that exist.
Unfortunately, security often doesn't seem to feel the need to explain themselves or discuss anything if they have a magic edict to wave about. I think that's a mistake, we should try to bring people along with us. And even find out we were wrong occasionally!
Sounds like better PR might be in order. If you're quietly averting disaster that's not enough, you have to make sure people are aware of that. Easier said than done, I know.