Some things make more sense when one realizes that there are at least 5 distinct security communities: Security product people (people that view security as something that can be added by buying/selling products), Security Infrastructure people (people that view security as ...
... something that needs to be deeply engineered into the platforms), Offensive security folks (people that build real-world attacks), Conference-security-research folks (who research possible vulnd in order to publish), and non-platform Defenders (who work on defending ...
... systems and infrastructure while only having limited agency to change it structurally). Each of these communities has their own conferences, their own values & viewpoints.
Google at one point hired an exec that I clashed with almost immediately; it wasn't until much later that I realized that the reason we were clashing that I was thinking like an attacker or infrastructure rebuilder; the exec had spent their entire career in "security as product".
