The bad actors with the most incentive to keep the bugs in place are the same people that put the bugs into the system: lawmakers. They might occasionally close a bug, but they are not interested in preventing them being introduced. They sell these bugs/vulnerabilities. That's the business they are in.