[fenomas]

To be clear I was talking about the era when a lot of people were working on Flash - on attack or defense. These days (since, say, 2013-ish?) I doubt there are many working in either direction.

The point being, in its heyday Flash was a bigger target than any web browser, and I don't think its attack surface was much smaller. If Flash had 10x more vulnerabilities than browsers did that'd be bad, but I don't think that was the case.