You think security fixes are a sign that software was built 'wrong'?

Of course. If it needs a fix, it was built wrong. We've become too accepting of low-security software. There's no excuse for this in embedded devices that don't do much.