Something interesting did happen around that time. Looking at all CVEs as an aggregate, it appears 2008ish is about when there was an inflection, perhaps a shift from OS to injection/validation/appsec?

https://nvd.nist.gov/general/visualizations/vulnerability-vi...