'If all else fails' they would have to write the security firm a blank cheque. I know Apple have a lot of money but the fee would likely be astronomical. Unless, of course, Apple wanted an ongoing contract with the firm to dig out vulnerabilities (on top of whatever they already do). I wonder if that sort of relationship would be economical for both parties.