That is why then there are folks like me, complaining in code reviews, or adding configurations into the CI/CD pipeline.

However it is indeed a quixotic battle in some scenarios, regarding security best practices.