> We also found that the rate of new contributors increased overall after switching to Rust, implying that this decrease in vulnerabilities from new contributors does not result from a smaller pool of more skilled developers<p>That seems like a dubious line of reasoning. People learning the shiny new thing are going to be itching to use those skills in a (non-local, non-hobby) project, and that seems a much more likely explanation for why contributors increase during the stage where Rust is still shiny and new. An old codebase in an old language doesn't have nearly the same appeal, where contributions are going to come mainly because people want to scratch their own itches. It's a false comparison that doesn't contraindicate the self-selection effect at all.