Because all software is insecure.

You hear a lot about them because they are used in government and large enterprise environments when threat actors love to attack.
Having a responsible disclosure process where they announce problems so their customers know it's patching time. It's better then it use to be where a vendor threw out a patch and if you didn't patch because the vendor didn't say why the patch was released.