The bad guys will find out first.

Back when I first heard that, the bad guys were bored and/or hyperactive teenagers who understood how computers work. Today we are talking nation-state actors and nation-state-sponsored actors with practically unlimited resources.

Keeping your code secret will not stop them, cf. WhatsApp. "Responsible disclosure" will not stop them either, and sets up all the wrong kinds of incentives for vendors to sit on problems until just before the "responsible" disclosure window closes. And FFS, there are still grown adults that believe building backdoors into E2E won't be exploited by the bad guys first, insofar as they are not the bad guys themselves.

I only have questions, not answers, and I don't know what we do from here.