No, they really don't. Exploits are rare, relative to the amount of code being run. And most "threats" are discussed absolutely, instead of relative to a threat

No, they really don't. Exploits are rare, relative to the amount of code being run. And most "threats" are discussed absolutely, instead of relative to a threat model and mostly devoid of any context.