exactly. and people promoting closed source security updates should print this risk out in most clear fashion. if we want to hold GNU to account for security then we should definitely do so with closed source vendors too