Right, and we don't know, which means we should audit aggressively and assume these things may still be open attack vectors. You don't hang out with the backdoor open waiting for your friend to let you know.