[layman]

There is a difference between "has zero security flaws" and "not fixing a security flaw for 6 months after being made aware"