In reply to Miroslav Glavic.

It is not easy to audit for product that has mature and huge codebase, and of course, it's not cheap. Even your source code has adopted in many companies that runs security audits.
Take an example from shellshock vulnerability from most popular Bash that remains back from version 1. Many popular linux distros and even Apple OS X use Bash but this bug was found on 2014, which over 20 years from first major release.