Despite some lofty promises, pricey security investments do not necessarily guarantee an application is immune to vulnerabilities. In fact, they may lull developers into a false sense of security.