... or those who don't know about constant-time functions, the difference between sha1 and argon2, etc. etc. I had to fix such things several times in corporate internet-facing systems. A generalist engineer can do this just fine, if they're aware of the state of the art, but there's nothing ensuring that they actually do. The compliance tickboxes were of no help here either.