Or take software. Does anyone actually believe that it was harder to write code for the ActionScript interpreter than it was to get Dowd's exploit (http://bit.ly/13OjyR) working?
It's not my intention to disparage Dowd's work in the least, but yes.
For all the cleverness involved in breaking software, it still takes years (decades?) of clever man hours to produce a secure, well performing virtual machine.