If you think getting every single developer in your organization to threat model every single feature using a repeatable, easy, on-rails process could be a terrible idea: you're right. If you think appsec is fundamentally structured data problem being approached as an unstructured train wreck: you're right. If you think these two problems might be related and there must be engineering solutions to it: you're right.