There is no objective way to measure the security of an inherently insecure system.
Assume breach.
Assume breach.
not just a context-less number that means they're popular, audited, or reviewing their OWN code all the time.
Instances where 0-days can't be used in isolation are a perfect example of where nontechnical people absolutely need to "just trust" someone to triage, and perform threat modeling for them.