This is possible. However, I read many of the papers and Final Evaluation Reports from this time period. They usually found the common and some uncommon flaws in systems with feedback to vendors. One of a UNIX aiming for higher assurance heavily criticized its lack of hardware-level enforcement and architectural issues. They also standardized on assurance and design techniques with similar re-applications to ensure what worked before would again. Evaluations were done by people from private labs and NSA's IAD hackers sometimes repeated by other groups.

So, altogether, they probably got plenty of review. They could still use more from independents with great skill. So far, though, solid in review and the field in high risk is saying something.

Re hiring a former NSA officer

Others and I have been telling all of you for years what they're capable of. You just look at each layer or compondnt to see what a subversion/breach would do. Then read years of papers showing how to avoid those. Then notice what each product is or isnt applying. Then you know they were breaking almost all of it. ;)