I think this is missing a huge part of the point of the article: the complexity of the standard and the domain space it provides makes implementation errors mor

I think this is missing a huge part of the point of the article: the complexity of the standard and the domain space it provides makes implementation errors more likely. It’s akin to saying “making a web browser is easy, just follow the spec”; but the spec is a sprawling set of standards, with many layers of revisions and many important details left up to implementations. In both cases, implementations may not be nearly as cautious about the finer points of the spec. That’s a huge weight for either to carry, and probably the only reason we haven’t seen a similar proliferation of browser implementations with horrific vulnerabilities is that the spec is so huge and the incentives to build a new one are so low.