One consulting project involved 900 modules in 200 directories. I opened modules and skimmed through, and the bugs were just everywhere. (No, not false-positives. Once flagged, you can read carefully and prove the bug). I abandoned that source base as unredeemable and wrote a simple 10-module driver to replace it. (The customer rejected it, couldn't believe I could be right. They hired somebody else, the product was cancelled and recalled 9 months later).