True but trivial. It's much more instructive to pay attention to the rate at which vulnerabilities are discovered. For e.g. qmail that rate is very close to zero per decade. For less secure products the rate varies over time; some researchers have noted a sort of "honeymoon" period that protects new code. Packages that don't in some sense eventually "settle down" after that period ends might ought to be replaced. Or perhaps they are important or unimportant enough to mitigate their vulnerabilities through other means.