They're novel instances of a bug class, the same way a new use-after-free in Chrome is a novel bug. This is what makes crypto vuln research so great: the published work deals mostly in bug classes, which can be leveraged against systems ad infinitum.