Learning a large code base is hard, but until a hacker really understands the package being audited, any fixes are more likely to create bugs then remove them. But once you reach a point where you can confidently audit code in a particular program, you're also at a level of understanding where you can spend your time creating cool new features instead. Or something like that. It is not surprising that auditing work tends not to get done. It sure would be nice if more such work did happen, though.
Software truly benefits from being looked at by multiple people.
The various companies out there that depend on Linux could also, perhaps, dedicate some of their staff time to auditing tasks. Even better would be a shift in free software community ethics to recognize code auditing as the crucial and difficult task that it is. There is, at times, too much emphasis on the people who crank out the code, and not enough on those who really make it work for everybody. When auditing becomes a highly appreciated effort, maybe free software will achieve its potential for top-quality code. IP Filter licensing followup .