Yeah until you realize that a lot of small scale companies do the same thing with avg/bad developers for ages and ... It does work.

IF you don't have a central security team like in big companies or the need for an audit, what you don't know is what you don't care for.

Obviously until its too late but holy shit i have seen too much garbage just working for waaaay to long.