Hey @espina! We worked with Ackee Blockchain Security. We (as in Rhinestone) also funded the audit for the ZK Email recovery module. It was slightly below 4k USD. The rest of the audit (from a Solidity perspective) was on their core contracts and was a lot less than 75k.
ZK Email is a public good and 100% grant-funded, and I believe the quote you are referring to (that specific proposal you linked) relates to getting all the ZK Email offchain infra (ZK circuit, relay, etc) audited.
Module diversity is an interesting point. When modules need to be opinionated and meet different product requirements, module diversity can be important. From a security perspective, modules should be scoped and well defined to reduce unintended outcomes. When a module has a specific function that in itself can be used in a general manner at the application layer, I believe we should focus energy on establishing a battle-tested and composable/reusable module (e.g., passkeys, session keys, etc.). This is just a general comment though. It’s hard to apply this reasoning without knowing the proposed spec and exact functionality of a module.
