About 95% of software bugs come from common, well-understood programming mistakes. Today's developers ... oftentimes don't have the academic discipline of secure software engineering and secure software development and training around what characteristics would create flaws in the program or lead to bugs.
One of the problems is that the educational establishment generally doesn't teach secure programming at the undergradute, or even graduate level.