Correct. But you have to assume the spies have vulns in there, either intentionally added, or, if they found vulns, they simply reported them to their agency, instead of their employer.