a lot of your suggested vulnerabilities could be prevented from appearing if company just hired a person who can configure SAST and WAF and etc solutions (solving a class of security problems from showing up on a platform level, not on per each vulnerability instance level).
Why rely on an in-house redteamer who may find one or two vulns per year, or may not.
Why rely on an in-house redteamer who may find one or two vulns per year, or may not.