Ask HN: How do security researchers know where to look for vulnerabilites?
They look everywhere, I think its a case of survivor bias where we only see when they succeed (via published bugs). We don't hear about the thousands of times that they failed to find anything.