> We further compare our findings with non-cryptographic systems, observing that these systems are, indeed, more complex than similar counterparts, and that this excess complexity appears to produce significantly more vulnerabilities in cryptographic libraries than in non-cryptographic software.

This, to me at least, seems like a strange conclusion for this paper to reach. While there are evidently more vulnerabilities reported in NVD/CVE for cryptographic libraries, does this necessarily correlate with a larger number of vulnerabilities being present? Or could it be that cryptographic code is much more heavily scrutinised, and so it’s more likely that vulns will be found? I think the former is probably more reasonable, but I’m not sure you can come to either conclusion based on CVE data alone. Or am I missing something?