I disagree that its harder. Sure to be an expert security engineer is harder than being an average programmer, but so is being an expert at algorithms.
I also don't think ctf's are a good model for security questions during interviews. Knowing how to do something securely is not the same as knowing how to exploit a vuln.
I also don't think ctf's are a good model for security questions during interviews. Knowing how to do something securely is not the same as knowing how to exploit a vuln.