I think I get where you're coming from. I've worked mostly on small teams (sub 30) so it's always been on us. The engineering leadership never prioritizes security unless it's something as big as the log4J stuff because it was on customers' minds.

That said, if they're software packages from something like Node or PyPI, I do think that it falls on the developer. If the point is that leadership needs to give devs the ability to act on that, that's very fair.