It's a huge code base, of course there are security issues. Same way IDA and radare have security issues. People who reverse malware take that into account.