> Just because you don’t link to or call it… if you include vulnerable code you’re still vulnerable.

That makes no sense. If you never use the vulnerable code, how would an attacker access the vulnerability through your system? Especially with DCE, the vulnerability might not even be in the binary.