The problem with that approach is if a critical vulnerability has been discovered in the current firmware, and you are advised to upgrade ASAP. If you also want to wait a week (or longer) after the latest firmware has been released to ensure that there is nothing wrong or malicious with it, then you are essentially stuck without being able to safely use your device in the meantime.



Ledger have a Bounty Program (http://www.ledger.fr/bounty-program/) for people who find bugs, so they can be responsibly disclosed and patched. Ledger even said in their response that "We regret that the researchers did not follow the standard security principles outlined in Ledger’s Bounty program." I can see where you are coming from, and in an ideal world there would be no issues whatsoever, but this is an unrealistic standard to hold. Bugs will always be discovered, and we can't really expect them to fix a bug they weren't informed about. This video was posted on the 27th and they had addressed it by the 28th. I think that's pretty good.