They thought QubesOS was secure but they found a trivial sandbox escape to root today.

Yeah, it’s well known that you can prove the presence of bugs but you can’t prove their absence.

All software is to be considered insecure, formally speaking.