>Security is built out of generic programming concepts, rate limiting, input validation, authorization, encryption, etc.
With the exception of rate limiting, those are indeed security techniques.
The generic programming concepts, like Atomicity and rate limiting are generic because, although maybe relevant to security, they would exist even without malicious actors. Atomicity for example is used on disk and database writes to avoid ilegal states in the case of power outages or crashes. Rate limiting on the other hand would still exist without malicious actors, to distribute limited resources when demand exceeds supply. And it often is used in the context of paid apis with different pricings based on different limits.
So in essence some concepts strictly exist to protect against malicious actors, while others protect against random conditions or good faith actors.
>With more programming experience you’ll understand the mapping of studying crypto smart contract vulnerabilities and applying lessons to a non-blockchain database.
If I'm not mistaken you started learning about programming and security very recently (which is why you can't distinguish between the two) and mostly through chatgpt? Might pay off to be less cocky, or maybe it's a good strategy so that veterans correct you, either way, all the best.