Indeed, then it becomes a market and it incentivises more research on that area. Which I don’t think is helpful for anyone.It’s like your job description being “professional pessimist”. We could be putting that amount of effort into building more secure software to begin with.