It requires management buy-in, both to allow some number of engineers to be allocated to such "non-production" work, and also to allow the friction security creates to continue to exist and "slow down" the "real work", both by vetoing things that would weaken security and by forcing everyone to use more cumbersome workflows.

That usually doesn't happen unless the company has suffered a large financial or reputational loss as a result of poor security practices. Sometimes not even then, if the company doesn't get scared they'll start losing money or get in some sort of legal trouble.