Even safety critical software can run reliably for the range of inputs that it's likely to ever see, but contain security holes.

For something like OpenSSL, it must produce a correct output for every single possible input. Even safety critical software may extremely rarely fail in unusual conditions. For security sensitive software though, all it takes is a single possible input that will trigger a bug, because the attacker is not a random process.

Writing secure software in C is extremely difficult.