When I look at Zoombombing, it seems like the sort of thing someone should have flagged internally early on. I don't know anything about Zoom's culture, but a case like this makes me think being security-minded isn't in their culture. You can also see that in the CEO's statement about end-to-end encryption; his logic about how free users wouldn't get end-to-end encryption so Zoom could cooperate with law enforcement was non sequitur. Or look at how they handled Zoombombing and the lobby: if you call a contact, they still have to be admitted. Development is also mostly in China to save money. I buy the explanation, but even in 2011, China didn't have the best reputation for privacy and censorship; other countries would have been better choices.