That was a subtle strawman.

The post you replied you clearly asked why insecure argument handling should be discovered after release. You widened that to mean “every security hole must be discovered prior to release” which made it a much easier argument to attack.

The point stands that the insecure argument handling could’ve been discovered by a security audit even when every security hole may not have been found.