Isn't that just true for vulnerabilities in general? Trust Zone is not a security mechanism, it's an isolation mechanism.