Yeah, and defenders have the harder job. Finding a vulnerability is one thing, getting it patched and deployed across millions of systems is another. Attackers only need to find one that hasn't been updated. That's the bit that worries me more than the numbers.