I’m sure they make the flaws look like honest mistakes, and whatever gets found by someone else is simply patched with a “bugfix” commit.