Or pointing out how hard it would be to get a "bug" inserted into such a codebase. He's not saying that either endeavor is easy. His only point was that, give

Or pointing out how hard it would be to get a "bug" inserted into such a codebase. He's not saying that either endeavor is easy. His only point was that, given a budget of $X and an embarrassment cost of (abstract) $Y for getting caught attempting to degrade the security of OpenBSD [my interpretation of "risky"], spending those $X on the identification of existing exploits would be the more rational course of action.