Though there is one part I didn’t understand in that interview. They were complaining of being overwhelmed by AI submitted bug reports (fair), including for obscure codecs that must have been used by a couple of users at most. And therefore implying that securing those codecs is low priority/important.

I don’t understand that. To me the severity has nothing to do with how popular is a code path, but whether that code path is accessible to an attacker. If I upload a specially crafted .mkv with a little known codec on YouTube and they use ffmpeg to process it, and I compromise YouTube’s infrastructure that way, it’s a pretty big deal, no matter the popularity of that codec.

It's a really good interview. I recommend it too.

Link?