https://www.netrise.io/xiot-security-blog/when-the-secure-stack-isnt-so-secure-lessons-from-the-f5-incident
I was an employee of F5 for a number of years. Development of F5 products (especially BIG IP NEXT) suffered from a number of significant issues - the largest being ego. The architects and senior/principle developers could do no wrong. Because of their titles, they couldn't be questioned - they didn't have to explain their decisions.
If a test showed a problem, then the problem was that the test was written incorrectly. Go write it so that it passes.
The mindset of the majority of the engineers was coding for the golden path. Because of that it was easy pickings to find issues using the mindset of a hacker - do all those things that had not been protected against. Push and push hard. Three years at F5 were painful - BIG IP NEXT should never never have been released. My director ignored all of the data provided that it was not architected well, not designed well, and coding was an abomination.
BIG IP NEXTs short life is proof of this. It was good to see this article to confirm.