Comment by naming_the_user

I'm a little uneasy about the conclusions being drawn here as the obvious counterpoint isn't being raised - what if older code isn't being looked at as hard and therefore vulnerabilities aren't being discovered?

It's far more common to look at recent commit logs than it is to look at some library that hasn't changed for 20 years.