He's right though. We'll run out of vulnerabilities eventually.

Did you even read the comment you're replying to? Every new feature, heck, every new line is a new attack vector.

Im pretty sure more vulnerabilities are being created in new code all the time.