When I said "miles away from the kernel", I meant that the opportunity for the kernel to address problems in the application layer were minimal. There's little the kernel can to do, say, make SQL Injection less horrible.
So we have different meanings of security flaw. Probably because you are thinking of the security of a website, where I am more interested in securing the average users PC.
If a dent is really going to be made in this problem, it's going to happen in Flash Player (or its more recent analogs, like Google NaCL).
However the question on the table is research. We should be researching security models that don't rely on the user to manage the complexity.