No, you're not getting it. The reverse engineering itself is obviously extremely difficult work, but it's the work of an individual or at best a small team. Reverse engineering work only provides existence proofs of security issues, mostly singular instances. Taken to its extreme, some reverse engineers believe this means that all memory unsafe software needs to be rewritten. The sheer amount of software written in C or C++ dwarfs the size of the reverse engineering community in amounts I can't even fathom.