I think that poses an interesting dilemma. Say somebody finds a flaw: would they really want to disclose it? If they doesn’t, and nobody else has found that flaw or any other of similar importance, they stands to benefit more by hacking the system when it goes into production.