TeX's bug bounty and the credentials of its author are good reasons why it's probably one of the most reliable pieces of such code that you might have.
Knuth has an older and more narrow concept of 'bug' than the current common definition.
A "bug" in relation to the functionality of a layout software is also vastly different from battle-hardened code in the field of security.
Is to run that giant heap of probably not sandboxed or security-audited code in every client actually a thing I would want to have? I mean people are paranoid about js doing unwanted things, but a large distribution of tex code running inside the browser, really?