The parser is attack surface, but that's the only part of something like Photoshop that has to be secure. The actual editing features can be insecure.