The devs don't seem like they have enough time to deal with the code they have to write, let alone respond to security issues. (not their fault, of course)
Valve seems to have like 6 developers that work there and since nobody seems to fucking manage the company (literally, this is how they operate) I am not surprised at all. How they managed to put together half life alyx at all is astonishing.
Their development philosophy makes sense on the face of it. People, properly empowered, left to work on what they think is best, might produce really great results.
Unfortunately most of the time they don't produce any results at all.
Last time I heard there was less than a dozen developers "in charge" of Steam. Everything else was an ancillary project that sprung up and shut down around it.
Valve is a dream job because of that philosophy. It's like the golden age of Bell Labs (which got us things like C and Unix...). "We're printing money. Let's get a bunch of smart people together and see what they come up with."
Valve has made enormous leaps in the quality of gaming on Linux. If they keep that up, I don't care if they never release or update another game ever again. They also designed the Index, which is probably the best VR headset on the market right now, and are engaged in VR research in general. HL Alyx (which I want to play, but don't have the hardware to do so yet) is basically a tech demo...and that's really what Valve has always done. They make tech demos that just happen to be full games that people like. The lack of a Half-Life game for so long speaks more about the lack of anything revolutionary in gaming for multiple decades.
A mountain of money does not necessarily (or even likely) make a good game. Yet Alyx was one of the best titles of 2020 and probably the best VR game ever made. Color me impressed by Valve’s game development team, regardless of the incompetence of their security practices
https://www.youtube.com/watch?v=k238XpMMn38
The devs don't seem like they have enough time to deal with the code they have to write, let alone respond to security issues. (not their fault, of course)