How can they estimate the existence of a vulnerability that has not been discovered and documented? The hubris to assume zero latent factors!