[qaq]

Almost 90% of breaches start with an email so code your developers write have very little to do with primary attack vector. You have to realize that well resourced APT like say APT-29 actually run research labs where among other things they test their exploits against all top tier Endpoint security solutions. So if you are a target of well resourced group they are going to get in.