It's a terminology issue. Economists use the term productivity in a certain way and they even use the term "broken window fallacy" to describe this debate.

https://en.wikipedia.org/wiki/Parable_of_the_broken_window

Basically, if you accept this line of reasoning, then someone going around breaking windows and someone else going around repairing them can be seen as good because it creates jobs. But that would be nonsensical and create poverty. That's why economists focus on wealth creation not job creation.

Fixing security bugs is only needed because people exploit them. It creates work but it doesn't create wealth.

There is a sense in which productive is being used here that is slightly subtle. Security doesn't really add anything to net output. It is, in other words, a cost. That doesn't mean it isn't valuable.

One way to think about it is that production allows you to pay for stuff. Not necessarily directly but by way of trading. It is the output you use to buy things like security.

Consider an apple farm. What does the apple farm produce to pay its bills? Apples. They could also dedicate resources to pears, &c, and that would add to their production -- to the goods they produce, the goods with which they (indirectly) purchase tractors, fence posts, &c. They could also dedicate resources to security -- more fences, &c -- and this may even be prudent. Maybe thieves are getting taller. This doesn't really add to production, though; at best, it maintains production at the status quo ante (assuming the fence is effective).

Just like securing a system is a trade-off, attacking one is too. Risk vs reward and time vs reward. Your personal blog doesn't need to be fort Knox, just patch it properly and you should be fine.

The software is better in the end but not all of it will be productive.

  If that same city was subjected to weekly riots

Okay. What's causing the riots?

  That's productive.

No that's spinning your wheels because an outside agitator is trying to make a quick buck.

> If that same city was subjected to weekly riots smashing windows & doors, and people regularly died..

The point it, this was not happening before. LLMs made cheap cyber attack possible. But it didn't make the implementation of fixes correspondingly cheap. So now everyone needs to spend extra money/effort to install grills to cover where LLMs fall short.

For postgres, this absolutely makes sense though as long as people are willing to shell out the profits from LLM use to support postgres development. That is one way this could workout for everyone..

This why we pay cybersecurity folks, developers and business people are often living in a fantasy land where people don’t steal bikes because it is illegal to do so.

Then they have a pikachu face when someone smashes their car window to steal something worth $50 they left on front seat because “who would do that?”.

What is even better thief will most likely pawn this for $10 but for him it is effortless $10.

And now imagine the introduction of iron has led to crowbars that make smashing doors a lot easier. Now it is quite unreasonable to account the reduction in smashing doors to iron, when the previous improvement was also due to iron.