"Security" is an application niche of programming and and such I don't think it is suitable for a category of it's own, or we would soon be making categories for similar niches. "Safety", "Algorithms/data structures", "Embedded", "Kernel",... I'm sure there's plenty.

"Software engineering" is just programming done in structured ways using established best practices - as a software engineer I don't think this merits its own category. Notably there are a lot of would-be engineers who just use "software engineering" as another way of saying "fancy programming" without really understanding the actual meaning. For example "designing programs" is not necessarily software engineering - designing programs in a specific way proven in use is.

Software recommendations is a hot potato were we haven't been able to reach consensus - some want these, some hate them. And if there is no clear consensus on this site, it would have to go to a site of its own.

Well, when is a category better for a niche, and when is a standalone site better?

Ooker‭ Categories are best when there's a different type of questions allowed on the same site. Take for example Code Review, where the way of asking is quite different. For things that are just like regular Q&A but a specific topic, tags is the appropriate solution. Unless I suppose one particular topic starts to take up a significant part of the site content - then maybe it would be better off at a dedicated site.