I guess that the perceived problem from a security perspective is that they're there, not that they're necessarily hard to fix once found.