Software QA is lame. People who work in quality assurance as software testers have never had much respect. They generally earn less than the people that create the bugs in the first place, i.e., the programmers. Software testers are often told they have only so many days to issue a passing grade on a release. Failing to certify a product for release has strong negative implications within many companies, and the course of least resistance is likely to be to just approve the product.
Security is different.
There is certainly some truth to that, which will be explored later. Security is also somewhat different in that lots of people are looking for software errors that can be exploited to lead to either an unauthorized access, escalation of privilege, crash of a machine, or any of several other nasty consequences. Yes, lots of hackers, many of them skilled in software, security and the Internet, are spending lots of hours looking for security weaknesses in commercial software. The answer, as you might suspect, has a lot to do with money. Imagine a graph where the X axis represents money spent on reducing security-related bugs and the Y axis represents the ability of the product to resist security attacks.