The gap you are pointing at is real, and it is probably the most underrated risk in Bitcoin.
Core gets the scrutiny because it is the thing everyone agrees matters. Wallets, Lightning implementations, signing libraries and the pile of JS around them get far less, even though that is exactly where a user's keys actually live. A hardware wallet with a hardened secure element still depends on the companion app, the USB stack, the firmware update path and a supply chain that most people never audit.
An audit being a snapshot is the key insight. It tells you the code looked reasonable on one date. It says nothing about the dependency that changed next week, or the maintainer who burnt out and handed a repo to someone who never cared that much. The projects that stay safe are the ones with a small list of dependencies and a smaller list of people who can merge, not the ones with the most badges.
So I would add one thing to your framing: the metric that matters is not "was this audited" but "how quickly does a real bug get found and fixed". That is the part continuous adversarial research actually improves, and the part most of the ecosystem still does not have.
The gap you are pointing at is real, and it is probably the most underrated risk in Bitcoin.
Core gets the scrutiny because it is the thing everyone agrees matters. Wallets, Lightning implementations, signing libraries and the pile of JS around them get far less, even though that is exactly where a user's keys actually live. A hardware wallet with a hardened secure element still depends on the companion app, the USB stack, the firmware update path and a supply chain that most people never audit.
An audit being a snapshot is the key insight. It tells you the code looked reasonable on one date. It says nothing about the dependency that changed next week, or the maintainer who burnt out and handed a repo to someone who never cared that much. The projects that stay safe are the ones with a small list of dependencies and a smaller list of people who can merge, not the ones with the most badges.
So I would add one thing to your framing: the metric that matters is not "was this audited" but "how quickly does a real bug get found and fixed". That is the part continuous adversarial research actually improves, and the part most of the ecosystem still does not have.