Security of a platform is a numbers game. If the cost of developing an exploit is lower than the market value of selling that exploit (either raw or productize

Security of a platform is a numbers game. If the cost of developing an exploit is lower than the market value of selling that exploit (either raw or productized), then the platform will be broken. All companies can do is increase that cost - ideally to infinity (eg unbreakable). There are numerous ways to do that, and at this point I think it’s reasonable to think that the cost being hit is time rather than money. There’s only a finite amount of engineering time available and how to spread that is hard. You could say that “everyone should be working on security”, but that doesn’t work because then people don’t upgrade (I recall multiple articles saying that people were updating to get even something as trivial as new emojis, but obviously other big features matter as well). You could say “rewrite the unsafe code in a safe language”, which is not something that could be done in any reasonable amount of time, especially while retaining ABI compatibility. So google, apple, ms, etc try to make the correct trade offs and improve the overall security posture of their platforms, but as long as there’s a market of organisations with functionally unlimited budgets the best they can do in the near future is increase the cost.