You're forgetting their SMTP server had a remote root RCE a few years ago, their IPSec server an authentication bypass, etc.

Both of these were logic bugs and not "insecure C code".