Security behaves just like any other quality property:
If your software is unreliable and causes damage to your client, you may be sued for compensation of damages, and/or get bad press coverage. The exact same is true for security issues.
Just like other quality properties, using a huge amount of money for one time events, is not likely to have a lasting effect. Ensuring quality in the long run requires structures that support it.
To be more concrete: A one time 3 day general security training for all developers may be quite expensive, but is probably not an effective way to spend the money.
A long term approach may be this: Appoint a small number of security experts and educate them (for example by letting them visit courses, get external consultation, ...). This group will
- identify the security aspects that are important for their fellow developers (e. g. a web application developer using Java should focus on OWASP instead of buffer overflows)
- support the architecture development group to minimize the potential for security related mistakes
- teach the fellow developers about security aspects based on the concrete architecture at use in their company
- do code reviews
- encourage discussions about security aspects.
Developers of business functions use these userinterface components. They don't need to write HTML code, so they don't need to escape input (and cannot because escaping is the task of the components). But business function developers need to understand how to use the components securely (e. g. don't generate HTML code themselves circumventing the components).