In my experience you are wrong. Two examples, one on security the other on quality and recalls. On security, we were building an Home Gateway, the modem you hav

In my experience you are wrong. Two examples, one on security the other on quality and recalls. On security, we were building an Home Gateway, the modem you have at home to access Internet. Before releasing it we realized the web page was vulnerable to a CSS attack. Since through the attack was possible to change the WiFi or the Firewall configuration we released the first version without these functionalities despite they were required by the users. The next release went through a two week pen test (consider that many of the competitors had the same CSS issue and were available on the market). Just a couple of day before releasing the new version, after the pen test was ok, I notice a phrase in the release note, I investigated a little bit and I discovered that the CSS issue was still there, it was just more difficult to reproduce (and a 2 week penetration test failed to spot it). What do I mean? That also the best security practice aren't enough to protect from all the possible issues. On product recall, same product, but on the hardware. Our hardware vendor was Chinese but we inserted in the contract strict clause on tests, product performance etc etc... After around a year we discovered that a huge product lot used a capacitor with problems and we have to recall all of them. The capacitor was produced by a reputable company and matched all the production standard when new. Lesson learned? Even if we obsessed over quality, you could have problems. The difference between a mediocre company and a good one is not that it doesn't make error, but that it is quick to solve its mistake and learn the lesson for the future.