I disagree that it's a common phrase. It's used primarily when talking about cancer or infestations. It is almost never used in any engineering context. Except when people speak about Flash. You don't find that odd at all?
It's inevitable when talking about Flash, but not, say, Windows, or other contexts with security vulnerabilities. Always "Flash" specifically "riddled".
I just googled the phrase:
https://www.computerweekly.com/news/252512175/Investigators-...
https://blog.avast.com/aws-freertos-riddled-with-security-vu...
https://www.zdnet.com/article/hola-vpn-still-riddled-with-se...
https://securityinfive.com/episode-659-tiktok-riddled-with-s...
https://www.computerworld.com/article/2490527/many-antivirus...
It’s a common phrase, not a conspiracy.
It might not be common vernacular in your neck of the woods, but it is where I'm from.