Developers build insecure software in part because themselves and in part because of the decisions made by their managers up to the CEO.

So when you write "developers" we must read "software development companies".