Anecdotally I know of an engineer in the Excel team. They would keep around a list of low priority security bugs. When they wanted to do improvements on the system they would attach it to one of the security bugs “nearby“ because the change would become approved much more easily than just fixing the problem itself.