This is more of an issue with the company than the developers. I have seen too often the move to Agile dev processes cause this problem. Instead of properly following Agile and continuing to improve and develop, the bean counters see a 1.0 release and everyone yells STOP DEVELOPING to save money and the POS 1.0 becomes the permanent final product. Google is really bad at this. They never improve a product beyond 1.0, just lets them sit stale for years.
The product should of never made it past PoC with such security flaws. It's solidly on the developers for taking the path of least resistance instead of doing it right. The only way to stop this from happening is to gatekeep with someone who is outside of the normal product development pipeline.
You absolutely do not iterate security, that's gross negligence.