Conversely though - doesn't that lead to bad habits?

If security is taught at the student level, by the time they get to junior developer they'll have an understanding of it / do it automatically.