[hilariously]

Chromium is probably 30 million+ lines of code, and we generally see that as things get more complex its even easier to accidentally write code which can be exploited.

If it has 1 vulnerability in every 10k loc of code we'd be talking about 3,000 vulns (with no churn) - we used to care about defect density, and most software wouldn't go more than a few hundred lines without SOME bug, whether that's a "vulnerability" is often a layered question.