[alphabetatheta]

I've commonly seen companies create secure by default programs around there deploying there Infrastructure (terraform/cloudformation templating). Maybe some companies do this with packages and vulnerability management. While its commendable to try this, until an organization is pretty large very little effort will be put into making secure by default design.