So you are saying at a certain point they should security-audit the software they run on. At what point does that mean the source of the PHP forum-software? At

So you are saying at a certain point they should security-audit the software they run on. At what point does that mean the source of the PHP forum-software? At what point does that mean the source of PHP itself? On what point does that become the source of the operating system PHP runs on? Add to this any other component involved which may or may not expose a security-risk, like MySQL, Email-servers, etc. I think while your attitude may be the right one, your statement is overly simplistic.