Also with cheaper outsourcing I'd assume all your remotely developed source is being stolen, and you have to assume being sold off.

Even more worrisome is code review companies seem to be mostly complete crap. Finding glaring RCE's in code in code that's passed multiple reviews is jarring for me. Mostly because I'm more on the operational/support side of things and write more scripting than code.