Not speaking about this particular security problem, but instead, more in general: Such management and snake oil people need not be incompetent -- they might j

Not speaking about this particular security problem, but instead, more in general: Such management and snake oil people need not be incompetent -- they might just have different goals, for example, their personal career and making lots of money -- and building very secure software can be off topic? Someone might seem incompetent, when the underlying problem is different goals? The principal–agent problem