Possibly because the developers of X, Y and Z test their own software for bugs and exploits, but nobody tests the combinations X+Y, X+Z, Y+Z, X+Y+Z.