[tptacek]

It's still not true if you leave security bugs out. It's basically never true except for a thin class of superficial bugs --- the bugs you'd intuitively expect to get diagnosed get diagnosed, but nothing else does.