> All the really bad security vulnerabilities were obvious.

Isn't that just tautological? They are bad because they are obvious?