Another reality
"free from all known vulnerabilities or defects affecting the security of the end product or service"
All the vendor has to do is stop effective security testing. Then by default they won't know about any such bugs.
What the law really should do is require a full security test report from the vendor, against criteria set by the purchasing agency, and preferably conducted by an independent thrid party.
Biting the hand that feeds IT
