Why bother when KGB hackers can already find a dozen of vulnerabilities just by looking sideways at a closed source project built by the most well-meaning team?