Developers do care about security. Often times they're not given the resources to properly address security issues and implement best practices because the business wants to ship faster.
This. I've established security programs at 3 companies over 10+ years. I've rarely encountered an engineer who didn't care. I've encountered many with competing priorities.
What gets measured gets done. Establish the right measurement to equip engineers to prioritize security and they'll get it done.
There was the DevSecOps push, but did it fail to gain traction?