Hah. It probably shouldn't be that surprising? Most engineers learn security on the job, not school. Game devs don't deal with -- and don't need to deal with -- the kinds of security issues Google and the military do.

Google has probably the best security team in the world, and they need to. The military deals with state actors by definition.

Gamedevs need to ship. I'm not saying they don't care about security, but short of some showstopper critical problem, it's not a thing and doesn't need to be.

It doesn't matter if your game is secure if nobody plays it lol