But "could have" is the theoretical defence. "Did" (or rather "didn't") is the real world test. This is the whole point - OSS offers the potential to be safer

But "could have" is the theoretical defence. "Did" (or rather "didn't") is the real world test. This is the whole point - OSS offers the potential to be safer but if there aren't qualified people with the skills and expertise digging into every nook and cranny of every bit of code. Ironically it's like the security services say - they have to win every time to win, the terrorists only have to win once. The community have to spot and fix every exploit to secure the system, the NSA only have to get one in to compromise it - and these aren't like accidental flaws, they're things the NSA will know are there, know the extent of and know precisely how to take advantage of them.