I wouldn’t say that. There are some not obvious things like timing attacks that you probably shouldn’t feel bad about.

If you’re still writing sql injections though, yeah, you’re terrible.