Battle testing finds uncommon bugs. This is orthogonal to whether these bugs are security-relevant. See, for example, shellshock, which was in a piece of softw

Battle testing finds uncommon bugs. This is orthogonal to whether these bugs are security-relevant. See, for example, shellshock, which was in a piece of software that's been battletested by most people who use a command-line for the past, oh, twenty years or so. Whether or not the developers actually know what they're doing with respect to writing secure software in the language of the project and are sufficiently OCD in their process to catch most mistakes before they reach production is very, very much more important than "battle tested for X number of years".