Hijacking control flow like this is not a hard requirement of exploitation. Vulnerabilities in a specific software release are not infinite in general so that doesn't mean much.

Memory safety issues, or ROP gadgets, and the like are basically infinite