I think we are asking developers to do too much by shifting everything left including security. While it should be a collaborative effort, the idea that developers need to become security experts, in addition to everything else, just isn't sustainable.