Neither. It is about having a color picker (probably just a few lines of code) bundled with quite a set of dependencies and complex chromium runtime environmen

Neither. It is about having a color picker (probably just a few lines of code) bundled with quite a set of dependencies and complex chromium runtime environment which does not get updated regularly. Therefore they keep their vulnerabilities even after they are known and fixed in later versions of the dependencies. With small footprint applications, you are less likely to have such problems.