> what if older code isn't being looked at as hard and therefore vulnerabilities aren't being discovered?

It wasn’t being look at as hard before either. I don’t think that’s changed.

They don’t give a theory for why older code has fewer bugs, but I’ve got one: they’ve been found.

If we assumed that any piece of code has a fixed amount of unknown bugs per 1000 lines, it stands to reason that overtime the sheer number of times the code is run with different inputs in prod makes it more and more likely they will be discovered. Between fixing them and the code reviews while fixing them the hope would be that on average things are being made better.

So overtime, there are fewer bugs per thousand lines in existing code. It’s been battle tested.

As the post says, if you continue introducing new bugs at the same rate you’re not going to make progress. But if using a memory safe language means you’re introducing fewer bugs in new features then overtime the total number of bugs should be going down.