I don't think the state should help out. This should be a lesson learned.

This bug was hiding in plain sight for years.

We need more incentives for security researchers to scrutinise open source software.

Don't trust, but verify and all that.