It's a fine balance.

You win most of the time, until you get log4jed or left-padded. Then my company survives you.

Also I might win even without vulns. I don't write frameworks, I just write the service or website directly. And less abstractions and 3rd party code can mean more quality.