That security bug you're talking about can be patched the same way it's exploited. No source code doesn't mean "all is lost". Instead of writing a payload that

That security bug you're talking about can be patched the same way it's exploited. No source code doesn't mean "all is lost". Instead of writing a payload that steals your private keys you just write one that patches out the vulnerability.