It's not clear if this was a scheduled vendor security review or if Tomaschik just looked into it out of personal interest. Google has done a lot of the former,

It's not clear if this was a scheduled vendor security review or if Tomaschik just looked into it out of personal interest. Google has done a lot of the former, for many years, even for physical security. The reports can be brutal. Think of Tavis Ormandy and his AV research, perhaps crazier. I remember a couple that were particularly bad and made me rethink everything I ever assumed about "security" systems.