I have a more nuanced take on this, which is that many engineers may have decent intuition on security - but that's entirely besides the point here, because without the political capital to have a large organization (and their customers and counterparties!) change their workflows and security stances, they're tilting at windmills. Security is not one of those things that one can throw bodies at - it requires true attention and commitment from leadership, and time to percolate across every facet of a company. If such a mandate is in place, talent is far from the limiting factor.