And their status history isn't much better. It's just that they are so much smaller it's not Big News.

For me it is their history of high-impact easily avoidable security bugs. I have no idea why "send a reset password link to an address from an unauthenticated source" was possible at all.