If an Application team is finding and fixing a lot of vulnerabilities and bugs is that a good thing or a bad thing?

The answer is it depends on the context.