Coinbase not a startup built by recent graduates...

You overestimate Coinbase's engineering rigor.

But yes security in modern software systems is a joke. I don't even get paid to fix security bugs everytime I raise them the answer is to slap a sandbox and proxy and call it done.