Comment by alexjameson

It's right for small projects that are created by people who know how to code in geberal. But there are also two categories where this might not be true:

1. Simple utilities that a vlogger or a sales guy created to automate routine. Such utilities are created in a hurry, deployed with prodiding private key to an agents, and so on. No attention to security was payed.

2. New generation of enterprise-grade slop that is produced by a relatively large group of people that don't review their work properly due to insane TTM and amounts of code.

Yes, their code might be secure in terms of simple techniques (agents help a lot of course), but in such code bases it's extremely hard to find out what should be fixed, how to fix it without breaking something else, and how to prevent something similar from happening in the future.