I agree, but imagemagick is kind of the worst of the bunch, graphicsmagick is a lot better and libvips significantly so. Ffmpeg primarily suffers a lot from “we need to support the video format used on a washing machine display used in 1981 and only sold ten units”. It’s quite a large vector for attacks.

ffmpeg also prioritizes high performance assembly code over higher level languages. Some ffmpeg members have also waste knowledge about optimizing for specific micro-architectures, on a level of Intel or AMD engineers.