And how many of those are remotely callable? It is a local exploit without something that makes bash directly callable remotely.

That's why mod_cgi or sshd (in one configuration) make this bad, they execute whatever command passed by design. To do that with most everything else, you would need a remote exploit in that program, making the bash exploit somewhat moot in that case. Or you're not sanitizing your inputs in which case you have another problem anyway.

Bash, on it's own, is not remotely callable.