20+ years of insecure code resulting in remote code execution vulnerabilities, lack of authentication and integrity, authorization bypasses and more. Yet a simple out-of-bounds read becomes the straw that breaks the camels back. Don't mistake my comment for criticism, I'm happy to see projects like this and non-security focused developers pay attention to such issues. But if you've spent more than 2 minutes in the security industry you'd be pulling your hair out at this point too.