Good security is invisible — its consequences only show when it fails. Good architecture at least degrades visibly. This asymmetry in feedback makes security harder to motivate.