Yes, that’s a good example of what I’m talking about. Even when they tried to subvert a cryptographic primitive, notice how they designed it in such a way that they could exploit it but other parties could not? Even making the attempt was unacceptable but I will say it’s categorically different than leaving an open source vulnerability unpatched. If they weren’t the ones who created it, they wouldn’t have noticed but not reported it – even our closest allies aren’t trusted with root on government servers.