C is absurdly easy to screw up like this. You need a lot of focused engineers, complete institutional focus on proactively catching things like this, and robust

C is absurdly easy to screw up like this. You need a lot of focused engineers, complete institutional focus on proactively catching things like this, and robust tooling to even have a hope of fixing all the low hanging security issues consistently. I don't find it hard to believe that Huawei missed one or all of those for at least long enough to make a patch.