The scope of use is very underspecified. If your program is disconnected from the internet, all remote execution bugs stop being security bugs. If you can provide specific input to run arbitrary code into a program that already requires you to have elevated privileges to run, it is not a security bug. Etc, etc.