their business is finding vulnerabilities in software, that could
cause vulnerabilities if installed on a web server.  unchecked
strcopy, iirc, was the ultimate source of the morris worm so it's the
sort of thing these people look for.

it's irrelevant whether it's difficult to "trip over the problem";
what's relevant is whether it's possible to use the problem to
construct an attack on the server that offers the program.

(we get personal service from our local cert team, because we know all
of the members well; if we get messages from any other -- even if it's
from the isp's team -- they tend to be pretty impersonal.  if you run
a service of any sort, you're likely to attract messages from cert
teams all over the place.  we do.)
--
Robin Fairbairns, Cambridge