They are, and again, believe it or not, more goes into it than “RCE bad”.

Ease of exploitation, feasibility do play a part which I’m sure surprises you.