Sometimes I even meet software developers who don’t fully understanding those topics.
"Even" software developers? That's kind of a weird thing to say. Programming as a discipline is far broader and deeper than most people realize (and that includes software developers!). Knowledge in one limited specialty does not translate automatically into knowledge in a different specialty and, indeed, can actively interfere with another domain without intensive retraining. (For a concrete example of this, just look at the abominations made in "embedded"^1^ programming by people coming at it from writing Yet Another CRUD-backed Web App.)
So it's absolutely possible for someone who's a real whiz with making web app front ends to have a very hazy grasp of security and privacy. It's a peripherally-related discipline at best.
^1^ "Scare quotes" used because I don't view what amounts to a PC running Linux in a funky form factor as meaningfully "embedded".