Once you get to execute arbitrary code there is little you can't do that the real program can, but unless everything is very bad a vulnerability won't allow you

Once you get to execute arbitrary code there is little you can't do that the real program can, but unless everything is very bad a vulnerability won't allow you to directly execute arbitrary malicious code. A buffer overflow might only allow you to overwrite few bytes or do a single jump. Attacker then has to leverage this very limited execution and turn it into running bigger piece of code. Many mitigation techniques focus on making this part as difficult as possible. If locating or parsing information to disable security features requires running few hundred lines of code but vulnerability allows you to directly execute only 10 instructions which can't even be freely chosen, attack might be prevented.