Well, "don't roll your own crypto" advice has recently been compared to abstinence-only birth control. It sounds well in theory, but in practices is prone to not work at all.

This is because most defects in security come from application developers assembling poorly understood third party solutions in ways that the original authors never intended or even imagined to be possible. Best practices and secure defaults can only take you so far, so there is a genuine need for minimum competence standards, even if those are informal and not regulated.