Why haven’t these been operationalized? NK resorted to social engineering in their latest bitcoin heist despite there been a thousand holes in the system.
To me, this points towards these holes are near impossible for humans and traditional tooling to find and Pandora’s box has been opened, or that these holes are not open to abuse in practice.
I guess the answer is that in most applications you are able to keep most users off the box altogether.