[ConcernedCitizen]

And let us not also forget the 2014 Goto Fail bug. Taught a whole bunch of people the importance of using brackets at the cost of clean code

If I'm understanding this correctly, Apple relies heavily on code-signing and built-in 'soft-fail' functions. The go-to fail bug exploiting a known (by Apple) code error with duplicate lines. This was patched soon after. The certificate revocation exploit was used for introduction of ransomware to devices through Apple's failed use of some of that same code-signing error from before, with tweaks to delivery and execution, but still similar. The code is not public so it can't be audited independently or peer-reviewed. The exploits are harder to patch and are therefore sought after by malware development campaigns and threat actors. You can't fix what you can't see.