In reply to Ron.

GPL software is offered with no warranty.

What you don't seem to understand is that it is not a spelling mistake. Writing a static analysis tool to look at a piece of code and determine if it is secure or not is practically impossible. This bug wouldn't have been caught because checking current_user_can( 'edit_user', $user_id ) is 100% valid in certain contexts. The two different checks aren't radically different.

Many people check every single line of code, by hand, that goes into WordPress core, it has quite good test coverage, and still security vulnerabilities exist. As they do in ALL software.