I was listening to a podcast on Security Now and they mentioned about how a lot of the of the security problems found in Flash were because when flash was first developed it wasdn't built with security in mind because it didn't need to thus flash has major security flaws in its design etc.

I know best practices state that you should build secure first etc. Some people or companies don't always follow 'best practice'...

My question is do you develop to be secure or do you build with all the desired functionality etc then alter the code to be secure (Whatever the project maybe)

(I realise that this question could be a possible duplicate of Do you actively think about security when coding? but it is different in the fact of actually process of building the software/application and design of said software/application)