We're almost into the third decade of the 21st century and we're still grading security bugs out of 10 like kids. Why?