If the business wants to dictate deadlines, the business is responsible for security.
Edit: I should say development team to include qa, but we don’t have those anymore at most places.
Managers and higher ups might like to pretend this phenomenon doesn't exist, and could pressure the teams to deliver "something" earlier because of their naturally slowed down velocity, which result in prod issues.
I've also been on the other end, where developers felt self inflicted pressure to deliver, because they saw how much they've slowed down.
They might be part of the business, but they usually have little authority regarding business decisions. Most developers are just told what the business wants.
It's the business that pays the wages. Also, time to market is most important (for everyone but Apple), coming later with a better product often doesn't mean a viable business. Problem is almost nobody is promoted for maintaining or improving an existing product, no C-level is interested in tech debt management/reduction, anywhere.
It's the developers who do the work.
This is the best that most separate security teams do, too.
In all fairness, the "DevOps" part of things can manage deploys in ways to minimize exposure. But most teams that I've seen revert to manual "process" whenever something unusual occurs, so forget about the ideal automated responses to problems we were promised when we were trying to automate sysadmins out of their jobs. There are several layers of broken here that we're not allowed to talk about.
I've resisted this, because I know that I can sleep peacefully at night when the inevitable monthly "GitLab Critical Patch Release" email comes.
