This is why the bugs are made non-exploitable by construction rather than by doing a bunch of work to show they're non-exploitable. There's an information asymmetry at work: the injector can craft all bugs in such a way as to ensure their non-exploitability, but the attacker has to laboriously prove the non-exploitability of each one.