yes, and we are going to see a lot more of that, unfortunately. heartbleed was another somewhat similar case, and though the debian openssl hole was probably accidental, nobody will ever be able to prove that conclusively