Even a single loop hole in the application can provide an entry point to the attacker
Security can never be a challenge in application that takes care of the top 10 vulnerabilities stated by OWASP
Development team has to know about the various threats that could impact their application and appropriately have relevant countermeasures in making the application fool proof on security aspects
Security is never a challenge if the development team addresses the application security completely