I was a security specialist at a large software company for a couple of years, and I did some developer training.

I'm not a roving security consultant, so my sample size is limited, but I have seen little evidence that even basic security awareness is part of the toolkit any substantial number of developers have.

My experience matches yours.