> (almost) all the low hanging bugs have been picked clean This has never ever been true. Every new framework has to design mass-assignment protection hopefull

> (almost) all the low hanging bugs have been picked clean This has never ever been true. Every new framework has to design mass-assignment protection hopefully. Every new language needs to handle file access. Every new authentication library will have to rediscover reams of textbooks/whitepapers.