Author of the article here, and I completely agree. With 25 years in web development, I've talked to many devs and given talks and workshops on developer security. In that time, I've seen many devs who want to care about security, but business priorities often push feature releases over security.
In the past, we handed apps to testers and moved on. Now, with PaaS (and to a certain extent IaaS), we sometimes get a false sense of security from network-layer protections.
Perhaps I'm too optimistic, but I'd love to see web devs equipped with the tools and knowledge to advocate for proactive security measures
