Yes I don't think that the government needs to plant vulnerabilities to get backdoors into people's machines. Finding vulnerabilities is not that difficult. The more moving parts you have and the more complex the code is, the more likely it is that there are vulnerabilities in the software.