Which is more important: security or system functionality?

I work with STIGs as part of my job. My first team lead had the mindset that systems should be locked down and developers should have to work within those constraints. If the devs' code didn't work because of the security settings, that was their problem, not hers. After I shifted to a different program, my new team lead said that that approach is wrong.

Which is the correct approach? Should developers have to defer to the security standard, or …

code constraints cybersecurity developers down important job locked mindset problem program security settings system systems team work