To be fair, Flash and Java were having an aggressive competition for enabling the most RCE exploits on end-user systems.

If we'd had the kind of support for sandboxing then that we do now, they probably would've survived a lot longer.