Developers who copy code rather than write it themselves leave apps open to attack, a study warns.