Viruses don't always exploit bugs. Most cryptolockers generally just trick people into executing them, for example.