Security vulnerabilities can only occur when the software bridges two different levels of privilege ("crossing the airtight hatchway", as Raymond Chen puts it).

Security vulnerabilities can only occur when the software bridges two different levels of privilege ("crossing the airtight hatchway", as Raymond Chen puts it). An EPUB reader has no business doing that, it can run completely inside the same restricted environment as any other potentially-malicious website. Other bugs, sure, but since when did presence of bugs prevent anyone - much less Microsoft - from shipping anything? Especially since the whole browser is going away anyway, so there's no long term burden.