question about patching/finding exploits

Let's say a team of developers are creating a new feature, they have now finshed that feature, but hold up a secuirty enginer has done some testing and found that teams code is the root cause of the exploit.

​

Would

a ) the security enginer fix and patch the code

b ) the devlopment team take advice from the security enginer, and go back and fix and patch the code themselfs.

Appreicate any replies.