This is the problem with big companies and big software projects. Your security is as weak as your dumbest/least trained dev team. This was probably thought of as a secondary priority project so the B team of C team got assigned to it.