Comment by waihtis

This may be true if there isn't a vulnerability disclosure program in place but there was, thus your point is completely invalid.