Unlike lockpicking or actual arms races, it is possible to write software such that the only weak point is the people using it. Ideally all software would be formally verified, but that's a bit too cost/time expensive to be practical for everything, so instead computer security focuses a lot on minimizing attack surface and getting as close as possible to that "humans are the weak point" goal. Even if a 0day exists for particular software, if there's no way to reach it, then it's as good as being nonexistent.