I'd say that's very organization specific. Personally I'd see the maturity curve being
No-one's doing it --> specialists doing it --> everyone's doing it.
With the speed of modern development, ideally everyone should have a good handle on basic security practices, ideally with a specialist team available for more niche requirements
No-one's doing it --> specialists doing it --> everyone's doing it.
With the speed of modern development, ideally everyone should have a good handle on basic security practices, ideally with a specialist team available for more niche requirements