I think you vastly overestimate the difficulty of getting a code execution bug on Rails relative to the resources of a nation-state. You don't need to do anything remotely suspicious; just hire vulnerability researchers. They're ridiculously cheaper than aircraft carriers.

Or, to put it another way, anybody with $20k can uncover an RCE in Rails without needing to suborn any community member.