Good points, I also think that they have easier fish to fry right now but that time will come, and the project needs to be ready for that. And when we start worrying is not a good time to start thinking about what to do.
I am a bit uncomfortable about the lack of shared knowledge about what are the attack vectors, when should we start to worrying about this or that, etc.
Thanks Nyx!
It seems the recommendations are: