> in practice, people will deal with the exposure either by treating it as an externality ... or by carefully positioning sqlite so it isn't a meaningful part o

> in practice, people will deal with the exposure either by treating it as an externality ... or by carefully positioning sqlite so it isn't a meaningful part of the attack surface. I think you're missing one of the ways. The one where people make no deliberate attempt to engage with the risk at all. No big throwing up of the hands. Sqlite is deeply embedded software, it takes years for a whole generation of smart TVs and security cameras and cars to find themselves in landfill and put a decade of vulnerabilities to bed.