I would however tend to disagree with this third law. There is an saying that says something like when you solve a bug you’ll be putting another one in that is harder to find. We’ve had this quite a number of times.

The metaphore of black and white balls is a nice one and is valid for bugs that have equal hardness. A bug that is harder to find is like a ball that is harder to catch.
When I look at your graph, I observer that bug hardness doesn’t drop under the value of about 3 once day 225 is passed. So it looks like single event bugs and double event bugs have mostly been found.
Further, I think we have to be careful with how bug hardness is described. In my opinion bug descriptions are localized to the block where they occur. Even if I find a bug during DMA transfer to the memory, I would still write that it happens during memory write bursts forgetting to mention all the conditions that are needed to get the memory doing this kind of burst to that memory. This is where separating IP Verification and Integration verification helps. It is more efficient to verify smaller blocks exhaustively before integrating them in a larger system that is verified too. And that might mean that one needs to split an IP into smaller pieces for verification. This is not often done and it makes certain bugs just harder to find.

To conclude: interesting idea that I’ll thinker about.