Security in general is hard.

It starts on developers own machines, which programming languages get used, how dependencies are added to the projects, how testing is done, how code gets written, how inputs and current user roles get validated.

All of this before even exposing the application to a BSD socket.