The blame lies entirely with government officials who sought out and purchased surveillance tech, and we should not blame the technologists who responded rationally to the incentive that local governments provided for them.

Our responsible disclosure and CVE info cycle and patch cadences and defense in depth, etc, etc ecosystem are tuned around a world where there's a relatively small number of bad 0days and the cost of said 0days is reasonably high. We can evolve how we address threats, but our models have read all of the best literature about how it's been done previously. Think there's a gap for people too small to gain access to "the good security models" - the nerfed closed models and the open models seem likely to fail to adapt, unless that gap is addressed.

You're always guaranteed that you can stash away the open models!