Therefore any time we see an implementation weakness it should be reported as an intentional backdoor? Is this really what we want? What would we then say if w

Therefore any time we see an implementation weakness it should be reported as an intentional backdoor? Is this really what we want? What would we then say if we got proof that they actually put an intentional backdoor in? That's clearly a much more serious scenario (if the vendor is surreptitiously working against you, you are much more screwed than the one bug youve found), and it would be nice to be able to communicate it. I thought that was why we had a word like 'backdoor' vs 'security bug'.