Yeah unfortunately this seems to be something very few outside of bug tech dedicate resources to. Even for them it seems to be an afterthought, at least in my professional experience. It winds up another compliance checkbox just like security.