Exactly. The scary part isn't any single bug, it's the mismatch between the sensitivity of the system and the apparent security model