Partly, but they also actively go out of their way to disable security mitigations for reasons that are unclear so I’m not all that surprised. On Linux I think they were one simple buffer overflow away from arbitrary code execution, which is all but asking for an attack if you parse data from the network in an unsafe language.