>...device drivers...

I hope you're joking but I suspect you're not. Device drivers have the highest level of privileged access in many operating systems and code quality for drivers is so uniformly lousy (certain large vendors whose names begin with "N", "A", and particularly "Q", I'm looking at you) that attempting to break the drivers would be among the first things I'd consider if I were trying to root a device.

Please see my other reply. I was addressing "unconnected software" not "software without attack surfaces". I agree that security is a concern with all software.

Well, in a sense, a device driver can usually be thought of as very connected to a highly sensitive part of a computer system. If something goes wrong in a driver it will have a negative effect on the whole (monolithic) kernel and the rest of the operating system.

Device drivers are a bad example, they can be extremely security sensitive (particularly so because they usually have kernel privileges).

There are few things where security doesn't matter. But they are extremely rare. The situations where programmers think their code isn't security sensitive are probably vastly more common.

Good point, but I was addressing the perceived lack of "code that connects to anything". I agree with you that security is a valid concern for most if not all code written.