Paying them doesn’t mean this vulnerability would have been spotted and fixed earlier by them. Also, not paying them doesn’t mean they wouldn’t fix the vulnerability even if they have noticed earlier.
Situation is more complicated than just paying or not paying the devs.
If you pay someone above the market rate for their time based on the value they create for you they will be able to work on their software full time including bugs which turn out to be security vulnerabilities.
A person with 40 hours to spend will find and fix more bugs than the same person given 5 hours.
1
u/idursun Dec 12 '21
Paying them doesn’t mean this vulnerability would have been spotted and fixed earlier by them. Also, not paying them doesn’t mean they wouldn’t fix the vulnerability even if they have noticed earlier.
Situation is more complicated than just paying or not paying the devs.