The scenario you present in the parent comment has echoes of https://en.m.wikipedia.org/wiki/Google_LLC_v._Oracle_America,_Inc https://en.m.wikipedia.org/wiki/G

The scenario you present in the parent comment has echoes of https://en.m.wikipedia.org/wiki/Google_LLC_v._Oracle_America,_Inc https://en.m.wikipedia.org/wiki/Google_LLC_v._Oracle_America.... - if I recall correctly they did "clean room" re-implementations of the same public API surfaces which in some cases resulted in identical implementations. To my understanding if some piece of code is the only / obvious way to solve a problem it's not an issue. To use a trivial example there's only so many ways you can implement a sum contents of array function, I'd imagine for many security vulnerabilities it'll be similar - adding a bounds check or whatever isn't going to be problematic just because you weren't first.