"One in 25 years" is far too optimistic (see e.g. http://secunia.com/advisories/product/2719/?task=advisories http://secunia.com/advisories/product/2719/?task=a

"One in 25 years" is far too optimistic (see e.g. http://secunia.com/advisories/product/2719/?task=advisories http://secunia.com/advisories/product/2719/?task=advisories - the NULL pointer bug was exploitable only from programs already running on the host, so most of these "count" by your criteria), but yes - the article is nonsensical.