Yes, weeks or months of work goes into finding the bugs, and then working out how to exploit them. The continued "hacked in x minutes" crap is nonsense.