I wonder how many vulnerabilities exist in each project, and how long it will take for all of them to be patched (and any new vulnerabilities from the patches are also patched) until we get a bug-free system everywhere.

There's enough new code being written to feed the AI vulnerability finding machine that I don't see a way out of this mess anytime soon.