Comment by sippingabonedry

It's not as heavily audited as you think. They have like a dozen active developers.