Here's where the asymmetry of security bugs and feature bugs comes into play. Introducing a buffer overflow in a small unused corner / edge case of the feature

Here's where the asymmetry of security bugs and feature bugs comes into play. Introducing a buffer overflow in a small unused corner / edge case of the feature set allows an attacker to fully compromise the process, and it's thus a problem affecting a 100% of the users. Introducing a behavioral bug in the same unused corner / edge case, will affect only a very small number if people (possibly none)