If the programmer who created the site don’t know about security the site can be hacked every time. I think if a good hacker find the vulnerability and advise to the admin the vulnerability can be corrected, or maybe not. Sometime I find a sql and xss vulnerability in site and advise to admin, they correct just one of many vulnerabilities, probably they doesn’t give a matter for this.