Blocking 15 out of 16 exploit attempts sounds great, but you have to ask yourself how many shots you get, and since most people don't think "this program crashed: I should never run it ever again", this isn't anywhere near as helpful as it seems. If you crash my webserver, I spawn a new one. You might even already have 16 webservers running right now! If the user clicks a link and their tab crashes, they might hit reload a few times before giving up. If you receive a text message or an email that crashes a parser on your phone, the retry might seriously happen in a tight loop. Like, I hear about this sort of thing being a good idea constantly, but I have never once heard of it actually blocking an attack against any "normal" target (I say "normal", as some super hardened military target might be configured to go into complete lockdown immediately upon a single unexpected event, with a protocol to call in a forensics expert to analyze logs to see if it is safe to restart the service before ending the outage).