The more intricate a process is, the more things there are that can go wrong. In the era when most application code sizes lie in the millions, the security assessment of both the codebase and the resulting application has to be carried out by professionals. In addition to the above, developers might not always be security-savvy or they disregard secure coding basics for multiple reasons.
Almost every software company performs security assessments on their products either by using security professionals that it has already hired or outsource them to one or more cybersecurity companies. Sometimes both. Our hackers are fully trained Bug bounty hunters and our results are undefeated.