"skimp on engineering" doesn't just mean not hiring enough developer skill to keep up with bugs & vulnerabilities.
it also means caring about & investing in developer expertise. companies basically don't do that, because they'd rather have their devs build some minimal viable-if-you-squint product and then *lay them off* and keep collecting rent on it.
devs aren't stupid. if their employer thinks they'd expendable, why shouldn't they treat their work as expendable?