They could have reimplemented it in a safe(r) language and runtime. It would have been a big effort, and Adobe extracted the maximum cash for least effort.

Comparisons with Windows don't make much sense because it is an OS and a thousand SDKs and ever growing attack surface.