X writes secure code, Y writes secure code, Z integrates both parts in a secure way. X creates a secure update. X releases an update which makes a race condition with Y leading to elevated privileges possible in Z's product. Who's liable for the issue now?
A hard problem - but what if that race condition kills someone? This used to be theoretical problem - there were not so many systems that could fail in so catastrophic ways - but we are now putting software into everything.
