[oasisaimlessly]

Are you being purposely dense?

If the mean number of CVEs is low enough, some proportion of software has 0 exploitable flaws, and is invulnerable regardless of how much attackers spend.

[saagarjha]

I consider that most software that people use is sufficiently complex enough that it will not fall in this bucket.