A security bug may well require enabling a feature, rather than disabling one, and then you end up with exactly the same problem. I personally detest #ifdef's,

A security bug may well require enabling a feature, rather than disabling one, and then you end up with exactly the same problem. I personally detest #ifdef's, and would rather have multiple .c files that I can choose from to include in my build. Code infected with #ifdef'itis is unreadable, difficult to test, difficult to maintain, ...