That still seems like a job for QA and you do have a good point. If there's an attack using one technique, there should be an audit to make sure that technique

That still seems like a job for QA and you do have a good point. If there's an attack using one technique, there should be an audit to make sure that technique can't be modified to be used in other nasty ways, then have those tests part of the test suite.