Happy Friday!
There is an interesting quirk I've observed across the various companies and clients I've worked with. Most folks assume that if something were serious, someone would speak up.
Take a typical team working in sprints or iterations, or whatever you prefer to call them. Most folks assume that if there is a real blocker, the team will bring it up there and then escalate to their leader if it is out of their hands.
How about a feature being built? Folks assume that if the feature wasn't truly valuable, someone would point it out, and it wouldn't be prioritized.
For security? Someone would point out if what you're doing is insecure and exposes the company to risk. Surely.