How do you know they're not doing exactly that? For every 1 vulnerability that gets disclosed, we have no clue how many potential vulnerabilities were caught by

How do you know they're not doing exactly that? For every 1 vulnerability that gets disclosed, we have no clue how many potential vulnerabilities were caught by security testing or practices. The entire nature of security is that it's impossible to have literally 0 vulnerabilities.