Browsers weren't as sandboxed and hardened as they are today, and flash plugged directly into them.
Flash was one of the most used vectors for adware, all you had to do was visit some shady website.
[Citation needed]
Let's look at the entire context.
https://www.zero-day.cz/database/?set_filter=Y&arrFilter_pf%...
And, yeah, Flash did suck as an end-user experience. For a few years it seemed like every restaurant in existence had an all-Flash web presence, and, no, waiting for endless animations while wading through some entirely non-standard "rich media" experience, while listening to my laptop fans kick into overdrive, did not "surprise and delight" when I was just trying to find their hours and a menu. It was absolutely infuriating.
This is ignoring that one of the major malware vectors that wasn't a zero-day at the time was to just put up a webpage claiming that Flash was out of date, and then linking a fake updater. Sure, that wasn't entirely Adobe's fault, but if they'd done a better job of keeping it up to date on their own it would have been an awful lot less believable to end users.