Let's say you're a software architect (dunno if you are or not). You hire four new software devs, two of them from Colorado State University, and you put the two from CSU on the same team. After a year, you find out one of them has been secretly working for CSU's cyber security research department and poisoning your product with patches that do nothing or subtly introduce bugs on purpose purely so their professor can write a research paper about your company's process. Naturally, you fire the developer and that leaves a bad taste in your mouth and CSU promises not to interfere again. Then you get suspicious and start checking the work of the other CSU dev more closely and find out they're submitting bad patches too! They claim that these bad patches were submitted because their experimental static code analyzer didn't find any issues with them.
What conclusion should you reach?