There's a (terrifyingly) large number of developers who don't qualify as "security-oriented programmers".