[MattPalmer]

One might hope that these low hanging fruit would be addressed, leaving more sophisticated attacks to fill the top 10.

Buffer overflows used to be a major vulnerability. These only stopped being such a major problem when languages that prevented them became widely used.

The lesson is probably that developers and the business don't have the time or inclination to address them, and the nest defence is to make the problem impossible rather than relying on good security practices being followed.