The bug lifetime analysis shows two things: 1. No matter how many eyeballs you put on a bug, it does not become more shallow 2. Each bug lives on average for

The bug lifetime analysis shows two things: 1. No matter how many eyeballs you put on a bug, it does not become more shallow 2. Each bug lives on average for 5 years This makes it probable that whomever puts enough resources on researching for bugs discovers them _before_ the developers find it out: 5 years is a very long time in terms of security assessments. It is reasonable to assume there are actors with enough such resources - these aren't necessarily neither large, e.g. states, nor malicious. They could be, for instance, independent researchers aiming to improve the kernel. That's what makes it probable these flaws are likely known to malicious 3rd parties.