“All the really bad security vulnerabilities were obvious.”
About one audit in five turned up a hole so bad the client got a phone call, and not one of them was clever. The startups that did best kept their engineering brazenly simple. Framework defaults like React’s HTML escaping did more for security than most security products. The expensive threat is almost never the sophisticated one.