Why are so few ML/AI candidates trained in AI security or adversarial testing?

I’m involved in ML hiring at a startup. We’ve interviewed about 10 candidates recently. They all have strong resumes and solid coding experience. Some even have real production LLM experience. But when I ask basic security questions around what they built, the answers are thin. Most can’t even explain basic concepts of model poisoning, evasion or model extraction.

One person built a production RAG system which was in use for a pretty large use-case, but I asked what adversarial testing they did, they could not give any concrete answers.

I’m not even blaming them. I wasn’t trained on this either. It just feels like the education pipeline is lagging hard.

Some of our senior staff has suggested we hire based on development experience and then we could do inhouse training on secure AI development and testing, but I'm not sure if thats the best approach to go with.

For folks here - did anyone learn AI security formally? If you had to upskill, what actually helped? And whose job is it, companies or individuals? Any pointers will be highly appreciated!