Vendor position on why the bug survived five years

Replying to a hostile comment, COLDCARD states its position on discoverability: the bug lived in public for five years, even third-party researchers did not find it, and the vendor believes it took the latest LLM models to find it. Held because it is the vendor's own compact public account of why the defect went unnoticed, and because other material held here runs against it: Lopp's explanation that the defect sat in the build system and that Ledger DonJon's repeated reviews missed it, a claim of a discovery eleven months earlier that was withheld, and a claimed drain report four years earlier. The archive holds the vendor's position and those counter-claims side by side and does not resolve between them; none of them is verified here.