In principle I see the problem, since we could potentially get a lot of lawsuits arguing if strcpy instead strncpy was a typo or malicious intent. However in pr

In principle I see the problem, since we could potentially get a lot of lawsuits arguing if strcpy instead strncpy was a typo or malicious intent. However in practice ( and assuming a well written law) most cases should be a lot more clear cut, since an entire rootkit is clearly not a typo. So thinking a little more about these issue, I think a reasonable test would be, if the developer directly profited/exploited an bug.