This is true at companies that treat security as a checkbox driven by compliance.

Not true at top-tier tech companies building software in product categories that by their nature have very high security requirements, like Fintech (e.g. Coinbase, Mercury bank, Wise).