Hosting multiple 100's of internally build complex services tends to enlarge the attack space quite drastically.

Where I agree most bugs are self inflicted, there are plenty found in acquired software too.