Yes, but the FFMPEG developers do not know this until after they triage all the bug reports they are getting swamped with.

With a concrete bug report like "using codec xyz and input file f3 10 4d 26 f5 0a a1 7e cd 3a 41 6c 36 66 21 d8.... ffmpeg crashes with an oob memory error", it's pretty simple to confirm that such a crash happens. The hard part is finding the cause and fixing it. I had understood the bug search to be fuzzing controlled by AI so I referred to it as fuzzing. Apparently though the AI is also writing the bug report now, so yeah ok, maybe there is potential slop there.

“Don’t ship software with vulnerabilities” sounds good in a vacuum,

I said KNOWN vulnerabilities. Make it known vulnerabilities without known mitigations if you prefer.

I wrote a few of those GNU coreutils that the Rusties are now rewriting. I don't remember hearing of any CVE's connected with any of them, though that is mostly because they are uncomplicated.

Here's all the Debian security advisories for the past year or so. There aren't THAT many, and they are mostly in complicated network programs, the Linux kernel, etc. Also a lot aren't actual vulns: https://www.debian.org/security/

This was the first search hit about ffmpeg cve's, from June 2024 so not about the current incident. It lists four CVE's, three of them memory errors (buffer overflow, use-after-free), and one off-by-one error. The class of errors in the first three is supposedly completely eliminated by Rust. No idea about the fourth. Not claiming that a Rust reimplementation of ffmpeg is anywhere near feasible. Dunno if the current set of CVE's are comparable but it's a likely guess. Anyway, as SPJ likes to say about Haskell's type system, the idea is to stop fixing bugs one by one, and instead eliminate entire classes of bugs. We can't fix everything but we can certainly do better than we are doing now.

I saw earlier you mentioned google keeping vulnerabilities secret, and using them against people or something like that,

That was listed as an example of what not to do, not a proposal of an approach to take.