A really long con would be to first identify some component than already has a naturally occurring, so far unknown hard-to-find vulnerability, and then slowly a

A really long con would be to first identify some component than already has a naturally occurring, so far unknown hard-to-find vulnerability, and then slowly add this kind of injected vulnerability to it. If the first vulnerability is eventually accidentally fixed by some normal refactoring, and if the second vulnerability if eventually found, everyone will revert back to the old version and now you can again use the first vulnerability.