It's usually pretty difficult to create an exploitable remote code execution bug in code without very obviously heinous (read: amateur level) code. Whereas with

It's usually pretty difficult to create an exploitable remote code execution bug in code without very obviously heinous (read: amateur level) code. Whereas with buffer overflows it's fairly trivial. Moreover, in order to exploit a more complex vulnerability an attacker would need to know something about the nature of the vulnerability, making it more difficult to come up with exactly the right steps to exploit it to maximum advantage. In contrast, with a typical buffer overflow you only need to tune how much junk to throw at the buffer before you start getting code to execute, and then you can just inject whatever existing payload you have already. This is so trivial that there are now tools designed to automate the process.