An attacker worth their salt will most definitely not fire all their CVEs at risk of crashing the target process or leaving it in an undefined state. And your

An attacker worth their salt will most definitely not fire all their CVEs at risk of crashing the target process or leaving it in an undefined state. And your second point is debatable. See defense in depth.