> A method to reliably produce vulnerability-free software is not invented yet.

I beg to differ. We have formal methods, ranging from type systems to full blown verification. This isn't a technical problem, it's an economic one.