Lack of security mindset. It's important to have the fundamental habit of assuming that every surface area you expose could receive arbitrary inputs and will not necessarily only interact with code you've written. But that's not an innate thing that everyone knows without explicit learning/training.
