Most attacker controlled execution code does not originate inside the binary, most buffer overflows inject shellcode. Using execution code from outside the bin

Most attacker controlled execution code does not originate inside the binary, most buffer overflows inject shellcode. Using execution code from outside the binary does not make it an RCE.