You missed my point. Is it easier to discover a novel exploit than it is to build software that is exploitable?