This is baffling to me for two reasons. The first is that my thesis is explicitly that this is not a defense and is not an excuse for poor memory handling etc.

This is baffling to me for two reasons. The first is that my thesis is explicitly that this is not a defense and is not an excuse for poor memory handling etc. in your firmware. (And the more I invest in creating a robust firmware, the more I stand to lose if someone rips off my product & undercuts me - security risks are not the only type of risk.) The second is that the notion that I should rely on the charity of unpaid graduate students to discover bugs in my firmware is both inequitable and unsound.