Some nature documentary explained why ants easily fall prey to anteaters. Why don't they evolve more defenses? It turns out the risk of anteaters is so low,

Some nature documentary explained why ants easily fall prey to anteaters. Why don't they evolve more defenses? It turns out the risk of anteaters is so low, that additional defenses are not worth the cost of e.g. slower foraging. Better count on the law of numbers, spread the risk over all ants, and get on with your life until you get unlucky. I think the same thing is going on with non-security reviewed software. The additional cost of thoroughly reviewing everything is so high and software is generally so good, that we can rely on word of mouth and past project behavior to make guesses that make economical sense. So git has proven a good enough steward in the past, and society swallows the cost of this update. Organizations trusting humans with $30 at scale has proven not to work out, so red tape grows like mushrooms in that region. And log4j2 might be an example of all of us stopping for a moment and evaluating if the cost is still worth it.