> The only difference here is that the organisation is a decentralised one. The engineers are not paid but are incentivised by the network.
ETH Engineers are also disincentivized from refactoring code / doing CD, as they have to pay a fee for every deploy. I'd imagine that the safety record for airlines would not look as it is today if engineers had to pay a small fee for every safety modification they wished to make.
The analogy with airlines is also faulty. There is no real financial incentive for a bad actor to find a software bug that is capable of crashing an airliner. There's nothing financially they can gain out of it. However, with the amount of money bound up in the ETH network even currently, any bug found by a bad actor could potentially land millions of dollars. Almost any amount of time spent pen-testing is trivial compared to that, so you will find a lot of bad actors actively seeking to find software vulnerabilities.
