Audited three times, exploited anyway: what the THEO hack says about security audits