I don't like the term "buffer overflow" because things haven't been that simple since the '90s (the recent Aurora kerfluffle happened because IE freed memory in the wrong order, no overrun involved). But yes, the point is you're trading a problem in a domain where we know how to mitigate problems for a maybe less likely problem in a domain where we have no idea how to mitigate problems.