I don't have such a source, but the Cybersecurity community throw accusations around easily, and are loathe to ever bless any software as completely innocent - which is a good thing.
When the accusations stop, the issue has either been addressed (typical outcome), or the product owner was written off by the Cybersecurity community as a lost cause (rare, but it happens).