On: Postgres 19 is late because so many more bugs are being found now

Explain that to the auditors… on whose lap does the decision fall?

There has to be a responsibility model for that; somebody who can say “we don’t do X even if the auditors say we should, because Y”. But I see where you are coming from, I’ve seen security theater to cost $$$$$$$ at the org I’m part of.