I think that even ignorance is organizational. As the article points out, we don't reward people for becoming less ignorant about security so why should they put in the effort to do so?
We can punish those who make egregious errors, like saving passwords in plain text, either literally or figuratively during code reviews (i.e., if a senior developer rejects a PR because it is too insecure)
Becoming less ignorant is time that could have been spent on this sprint, and is often punished.