In addition to that all sorts of vendors run their code on our systems to provide us with their features. And then there's the idea that some of these bugs have been demonstrated to be exploitable from within a JavaScript VM!