Yet malware creators rely on bugs to spread their work, so why not. Fighting fire with fire...

Right. But the problem is that malware creators can choose from many more attack vectors than security researchers typically can.

There are many things in the current state of security to be worried about, yet complacency remains high (which is one of the things...)

How is that scary?