Finding vulnerabilities and deciding which issues to fix first are two different things. The Cloudflare case is interesting because they look at actual requests and security logs in addition to the code.