The Tip of the Iceberg: On the Merits of Finding Security Bugs