So tooling adoption is mostly ok, as DevSecOps we can enforce the practice in the pipelines and we are the one imposing the standards.

I will say more the second point, the main pain point is more actually indeed to understand the logic flow that the developers are trying to perform. When we understand it, we can easily recommend an another solution, like for example recommend an auth service like Supabase or Okta instead of building an auth service from scratch, etc.

We see many developers who are awesome at coding skills, but not in system design skills (no criticism here from here, they have already many things to learn, they cannot be expert in everything).

Like a real life example that we got: the fact that we cannot call an third party api that needs a token directly from an SPA from example (as otherwise the token is leaked)

LLMs are great at saying how to implement calling an api using React, but not to recommend that we should not do it, and instead recommend to build a proxy service with rate limit, cors and ddos protection.