You're assuming that all security issues are obvious known ahead of time, and that's clearly not true. You can't compare your average remote code execution vulnerability with a speed limit. Speed limits are posted; RCEs typically aren't as clearly documented ;)