Vulnerability discovery and programming are different skill sets. I've seen terrible code written by talented security researchers.