My hearsay, from friends and colleagues that work(ed) there, is that the shipped product is not really where you see these "heavy hitters".. a lot of the maintenance happens offshore.
Just makes sense that they would put the "heavy hitters" on feature development, not backporting security patches.
Just makes sense that they would put the "heavy hitters" on feature development, not backporting security patches.