Hackers drain Bitcoin ATMs of $1.5M by exploiting 0-day bug

While I agree that previous engagements might have found vulnerabilities that may or may not be addressed (after all, that's up to the client) I think a core part of a decent source code audit or pentest is to find those so if that was the case then it could speak of the proficiency of those involved.

In my own experience I've noticed that a lot of times it's really hard to get the clients to address these sorts of issues, even when it's clear that they are critical and could directly translate to monetary loses which makes no sense to me but sadly doesn't surprise me at all.

Just to be clear, of course there is a scope and a web service audit doesn't usually end up with a thorough audit of all the packages used by the application because nobody will pay for that and even if they would, it's usually mind numbing enough to end up in people glancing over things and checking boxes but in most cases this is not the root of the issue.