It&#x27;s (relatively) easy to verify a software against a strict security definition and decide if it meets the definition or not.<p>It&#x27;s incredibly difficult (I&#x27;d say &quot;impossible&quot;, but I&#x27;m being pedantic for now) to check a flaw against such strict definition and check it against all possible use cases and all possible inputs and decide if one of them will lead to bad consequences.<p>Thus, if there&#x27;s any practical attack? How the hell would I or anybody else know. We can only know a resounding &quot;yes&quot; after you get owned, nobody can ever tell you a honest &quot;no&quot; to this question.