Why? The result for the end consumer is identical whether they have their PII leaked from "an external library" vs a vendor's own home-baked solution. It's no

Why? The result for the end consumer is identical whether they have their PII leaked from "an external library" vs a vendor's own home-baked solution. It's not really a different kind of mistake, it's exactly the same kind of mistake, because it is exactly the same mistake! This is talking the talk, and not walking the walk, when it comes to security. Publishing a writeup that passes the buck to some (unnamed) overworked and underpaid open source maintainer is worse, not better!