To me, it seems like a combination of several factors: * None of Adobe's products are particularly stable or secure - not even the ones they charge a lot of money for. * Flash's wide install base and the fact that it's easy to invoke on a target (via the browser) machine makes it an inviting target for hackers. * Flash is a fairly complex piece of software - after all, it's a language runtime. * They don't charge for the Flash runtime, so there's no direct return on investment for making it more secure. The main losses are reputational and until there's a mass revolt (which might be coming) it's hard to quantify any financial losses.