Quite likely. Considering the "bugs" that exist in hardware which the security auditor has no control over which is a "forced to trust hardware" exercise, before even looking at software bugs, it seems like a job to keep someone occupied whilst most of the population drinks from the kool aid decanter.