I don't know anything about how something specific like PII handling would fit into the frameworks of 'real' engineers.

Honestly? The handling of PII has already been enshrined in law because Software Developers let it get so bad lawmakers had to intervene.

The GDPR and it's equivalents in other countries are pretty clear on the subject: Unless you absolutely (functionally) have to, do not collect or process personal data.

And even then developers don't have the spine to recognize "hey, collecting PII like this endangers our users and is flat out illegal" and oppose actually doing it.

Or is it baked into the education, i.e. uni degree qualifies you for license => it's assumed you know not to build a bridge with fewer supports than required.

The main way it works in engineering is that the field itself, by way of it's professional association, writes standards and requirements. These are then enforced by licensing.

Which may seem extreme by current software development practices; "Oi, you got a loicense for that code?", but the reality conventional engineering has had to deal with for millenia is that their fuckups kill, and governments will strictly regulate their asses if they don't get their shit together.

Unfortunately, software fuckups do in fact still harm and kill, and we see the first steps of such strict government regulation in the abovementioned privacy regulations.