take a look at the history of pwn2own. It could be said that google chrome is one of the most actively developed projects period and people still find crazy 0 interaction exploits for this product.

You just need to threat model around that and limit exposure in case something like this happens. Most orgs dont get hit with 0 days. Therefore the best thing you can do is patch often, when possible.