Most projects can't afford a security expert.

You're saying something different - don't roll your own but reuse work done by experts and imitate their best practices.

Good article though, I learned things!