You're underestimating how many average people or below-average hackers find/stumble-upon serious vulnerabilities all the time.