So are there literally security researchers that go and poke around of every release of everything major in the software industry to find things like this?
There are. It's the main reason why "security through obscurity" isn't a good idea. There are people who spend their working days searching for this kind of stuff. Log files are probably one of the first places they would look for clues.
`grep password` isn't the hardest thing to do either
> There literally security researchers that go and poke around of every release of everything [snip] in the software industry to find things like this
Fixed.
Yep. Some are white hats hoping to either make money or reputation by discovering flaws. Don't think that these flaws don't get discovered; sometimes pentest experts discover flaws and keep them in their arsenal for a particularly difficult assessment. Other times, it's a blackhat who discovers them and sells them in the underground world. If you want to experience a jolt, visit www.exploitdb.com and search for vulnerabilities in your favorite software. And be sure that for every exploit listed, there are a few that are kept hush hush.
Yes, they are called "hackers" .. Especially the black hat kind.
It's actually a very lucrative business if you keep the security bugs secret and sell them on the market. Google "Vupen" for an example.