I can add a fourth item to that list:
4) assumed a critical vulnerability is discovered in bitcoin or lightning and it is mailed to the core devs. You want the core devs to be "good" or else they might use the bug to enrich themself before fixing and publishing the vulnerability.