I believe they mean that it is highly probable that any substantial C program contains significant coding errors, mistakes and vulnerabilities just waiting to be exploited.