Oh yes, because denying that your code has a vulnerability counts as a good security practice. You know why this MTA has that low count of published bugs? Beca

Oh yes, because denying that your code has a vulnerability counts as a good security practice. You know why this MTA has that low count of published bugs? Because nobody uses it anymore, so nobody looks at its code (and now factor in the ugliness of the code itself, which lowers the eagerness to look at the code even more). It's not because the code is (magically?) better.