You’re surely right about the incentives at play, and why no intelligence agency is going to spend millions doing x company’s validation work for them. But how in the world would selective patching work? How do you hide that?