In Microsoft’s defense, most organizations have security vulnerabilities in their code that all may or may not be aware of.

Just because Microsoft has software powering very important things globally doesn’t exclude them.