The vulnerability is really in the GNU licensed Xpdf. https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-into-nso-zero-click.html https://googleproject

The vulnerability is really in the GNU licensed Xpdf. https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-into-nso-zero-click.html https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-i... https://en.wikipedia.org/wiki/Xpdf https://en.wikipedia.org/wiki/Xpdf But you're right, the fruit company could have been more careful in their implementation. I also believe FOSS provides better security (in theory at least). Not sure it works in practice (expert eyes are expensive).