IMHO, the dual EC thing, as bad as it was, is completely different than the sloppy crap like a litany of hard coded passwords. One of these things has political complications, albeit ones that should not matter, and the other is an issue of basic engineering competence.