I think it's a relevant question here.

Parts of the exploit chain that was laid out in the blog posts that claim an RCE were bugs that have previously been reported. Dealing with them in the past in the severity you outline would have possibly prevented the exploit chain.

However, it's specifically the ability to complete this to an RCE what makes or breaks the headlines here.