At this point, one should assume that "attack the supplier" is a known, standard strategy for any person or organization that supplies software or expertise to a larger or target organizations.

This seems to get fuzzy when you consider there are many graduate students doing research who aren't going to have the same funds and likely not be as rigorous.

>You got to admit that's a pretty clever strategy: cast a wide net and convert your older already patched exploit into a zero day.

you'd think security researchers would know the importance of keeping their system patched...

Knowing the importance and actually practicing what you preach aren't always the same thing.