Aircraft are an interesting case where nobody except state actors can really afford to evaluate their security.

White hats and grey hats know the whole area is a minefield, and even a whiff of impropriety can bring the heel of the law down upon you. Airlines and aircraft makers both have a financial conflict of interests, discovering vulnerabilities and deploying fixes in existing aircraft could cost millions.

For NEW aircraft designs there is an incentive to discover and mitigate potential issues, but given aircraft's shelf life that might not be good enough over the long haul.

What can be done? I guess schemes like this one, that bring industry experts together with a real working aircraft and letting them try. But for political reasons even schemes like this could be unpopular if Boeing's shares take a hit and aircraft are grounded for service.