Almost never do software companies even attempt to design secure systems. I'm not sure this requires new fundamental research so much as slightly giving a shit.

There is a reason Mythos only found one bug in curl and it wasn't very bad.