Look at the number of horrific security holes in phpBB and Wordpress. Every other release or so fixes some new flaw.