[anigbrowl]

How many people have the time or inclination to validate everything that way?

[dripton]

Not many, but the effort is parallelizable. If you find a security problem and report it in public, others can verify it, and still others can benefit from the fix even if they never would have bothered to look for themselves.

[creshal]

It doesn't take many. The problem is making sure that someone is doing it (cf., OpenSSL).