just wondering.... wasn't the code just reviewed by what's his face?
A code review, especially by one person, cannot uncover every conceivable bug or exploit. The list of K.A. was quite extensive on possible attack vectors (and Evan took pre-emptive corrective action on some of them). But that doesn't change the fact that the more eyes on the code, the better chances there are to uncover issues.
Even with a team of developers, the right tools, and unlimited time, you can't identify "every" conceivable exploit. As long as you are running on dynamic technologies and platforms, what vulnerability that does not exist today, there is no guarantee it won't exist tomorrow. The idea is to spend enough effort to ensure finding vulnerabilities and exploiting them is not financially feasible for those with bad intentions. That's how security works.
