I have to pay them and teach them how to do their job? It's the basics as pointed out here. As part of their pay, they should be doing the security audits and code reviews etc.
And FYI, we tried telling them, e.g. Infinity for sure has and others too.
I like them and will continue to use them...