"Requires a 0-day" is still a huge barrier. It's not 100% secure, sure, but it's an improvement.