Do they accept invoices for patching their security flaws?
Are they liable?
That presumably depends on your tolerance for bureaucracy and pain.
That presumably depends on your tolerance for bureaucracy and pain.