> Relying on third-party, un-audited code was acceptable when the majority of contributors were from the West.

No, it wasn’t. It was always a really bad idea, and it’s been exploited repeatedly since the start.