It's somewhat concerning that Valve seems to disregard the importance of RCEs in server/client code, making them relatively easy to find.

There appears to be a lack of proactivity in addressing these bugs. Given Valve's substantial daily earnings from CS:GO through weapon skin sales, it seems their operational focus is more on maintaining the revenue stream rather than committing to quality engineering practices.