It's common knowledge. Literally no-one working in this field considers patching a buffer overrun or use-after-free or whatever to be the same as adding a security feature.