I think that assumes that people are actually auditing all the code, and carefully enough. I think most people greatly overestimate how much code is actually ever audited.