I've wondered this myself. I've tried a class similar to yours, where you were provided with binaries and tried to find the bugs in them. And it was hard. But

I've wondered this myself. I've tried a class similar to yours, where you were provided with binaries and tried to find the bugs in them. And it was hard. But when you consider that major bugs found now are being found by well funded teams or state actors trying to exploit them, it makes more sense that they would be able to work around existing mitigations due to the sheer manpower and resources they have to throw at the problem.