Interesting how they might think about trade offs.

I also suspect the NSA has automated how they find vulnerabilities in source code.

But yeah, so far it seems we let security be an open party, instead of requiring companies to audit a software or face penalties.