Can confirm. One of our customers (we're a security firm) was about to ship their modem/router with some firmware on it of chinese origin. The quality of the code (not just security bugs, but just bugs) was astounding. A colleague picked three lines of code at random, not even looking for a particularly bad part, to explain how this had multiple vulnerabilities. He identified four at first glance. Upon reviewing the report internally, we found two more. Six security vulns in three random lines of code. It was truly astounding.

Lots of them were mitigated due to other bugs preventing you from actually reaching the code when you pass funny input, or the code turns out to be unused (random unused code in your binaries is a big code smell). It was functional: they clearly made sure it all worked. But if you would try to do anything outside of the happy flow, it would bug. The customer also had quite a fight over getting the source code (instead of binaries) in the first place.