> Even if I prompt with security as the top priority

LLMs do really poorly with general statements like that, so not sure it's unexpected. If you put "Make sure to make it production worthy", you'll get as many different answers as there are programmers, because not even us human programmers agree what that really means.

Same for "Make sure security is the top priority", most programmers would understand that differently. If you instead spell out exactly what behavior you expect from something like that (so "Make sure there are no XSS's", "Make sure users can't bypass authentication" and so on), you'll get a much higher probability it'll manage to follow those.