In 2015ish Dan Geer, a prominent cybersecurity expert got up and said in a talk, we don't know if vulnerabilities are sparse in quantity or dense. If they are s

In 2015ish Dan Geer, a prominent cybersecurity expert got up and said in a talk, we don't know if vulnerabilities are sparse in quantity or dense. If they are sparse and there is actually such thing as a system that can be secured by doing the work of patching all the vulns up, then Dan argues that the US should be paying double what everyone else pays for bug bounties, so that the vulns get patched up and anybody who attempts to hide secret vulns will be aware their competitor(s) is going to cash in and be pressured to do so themselves. If vulnerabilities are dense and there will always be more than we can patch.. well computers are a strange beast.