The tooling to discover vulnerabilties advances just slightly behind the bloating code bases that are required to handle every stupid edge case that exists.