You'd be amazed by the large, boneheaded moves that even the smartest people make when they fail to think defensively. Any security holes, even when people see them, can be easily discounted by just 'eh, nobody will try to hack us'. I've seen that done in Fortune 500 companies whose main business is all about IP!
If you can't identify how likely you are of being hacked, and how much is there to lose if that happens, you'll make terrible security decisions, regardless of the engineering skills available.
If you can't identify how likely you are of being hacked, and how much is there to lose if that happens, you'll make terrible security decisions, regardless of the engineering skills available.