He's right though. We'll run out of vulnerabilities eventually.
Im pretty sure more vulnerabilities are being created in new code all the time.