[saltyshake]

not even for nation states/APTs? Are you sure about that?

[_tk_]

I can’t speak for Thomas- but generally you’d want to invest your money in a vuln that is rather static. Web applications with attack surfaces that are constantly changing are not a good fit for a sophisticated attack with potentially huge blowback.