Comment by kazinator

Programmers probably don't go out of their way to do secure coding not only because it's not mandated to them, but because they know that unverified code is junk. If security is a feature, it has to be verified. It's not the kind of verification where you can show that a feature works on correct data, and rejects incorrect data in some anticipated ways. It requires exhaustive code review, and a lot of cunning in the test strategy.