IMO, this is one of the drawbacks of Valve's famous flat structure + compensation being tied to stack ranking. Given the drawn out timescales for getting criti

IMO, this is one of the drawbacks of Valve's famous flat structure + compensation being tied to stack ranking. Given the drawn out timescales for getting critical bugs fixed, working on security is seen as boring or low value by Valve devs. Due to compensation being tied to stack ranking system, people are dissuaded from fixing these bugs as a result.