This is true for most sub-fields. The average person in them is either a failed dev or more of a pencil pushing box checker. The quality employees are devs with extra specialized expsrtise

Security, qa, devops, data emgonerkng, the list goes on and on.

Infosec also adds the angle that you want someone with actual grey or black hat hands on experience

I'm actually pretty good at data emgonering, one time I accidentally wiped our production db.