In my experience? Frighteningly real. You could also ask, "What are the chances of finding an application that has quadratic, cubic, or exponential scaling problems served on a silver plate right when he needed it?", and I'd also have the same reply - frighteningly real.

The most fun I've had in my days was not only demonstrating such security holes, but also finding laughably bad scaling issues while I was running amok. The most frightening thing is, I'm not referring to podunk little companies, but wholesalers or manufacturers with 9 and 10-digit annual revenues. And not small internal apps, but their main presence on the web.

Though I'll say, even as a contractor, these gigs are never enjoyable simply because - despite best trying to avoid it - you've managed to embarrass some people on an epic scale. Once you've fixed what you've been paid for, most places don't look to keep you around much longer unless they truly have a "what's right, not who's right" philosophy.