[tptacek]

I am, because reasons, quite familiar with the security review portion of the process. Not only is it mostly/probably not run this way for anticompetitive reasons, but Google doesn't even run the audits; they picked specific auditors (last I checked, Bishop Fox and Leviathan), both of which have gold-plated reputations.

Like I said, there are things I don't love about the program. But it's not an elaborate hazing ritual.