Well the bash vulnerability and then immediate disclose of another vulnerability makes that statement pretty moot.

We also have deeply layered non-hetereogenous kit so you have to punch hard to get through it all to something useful.