In Scrum (where User Stories also exist as part of Product Backlog), it is common to see Security, Availability, Speed of response and other non-functional requirements as part of definition of "Done".
This kind of coincides with your notion:
I.e. if developer implements some User Story, he should already
implement it with good security quality.
This is what Definition of "Done" means- all requirements from the list should be fulfilled in order for the User Story to be considered complete or done.
More on Definition of "Done"
More on handling non-functional requirements aka NFRs