Developers do care about security. Often times they're not given the resources to properly address security issues and implement best practices because the business wants to ship faster.
What gets measured gets done. Establish the right measurement to equip engineers to prioritize security and they'll get it done.