On: Ask HN: How do you become a security consultant?

If two weeks is sufficient, why aren't more people finding these things? Isn't there a big incentive to make sure that e.g. popular web frameworks are secure?