Those R&D stuff is more likely the vender's job, I don't think security consultant will get involved in a particular product's R&D. They do, however, point out security flaw/bugs in certain product.

But maybe I'm wrong.