Come on, people are not saying that "risks exist", they are saying that the risks are
very very likely.
It's a near certainty that I won't get hit by a car tomorrow - people do get hit by a cars but most people don't get hit by cars most of the time. There is a risk (a fraction of percent), but it's acceptable.
It's an even larger certainty that code will have bugs. As far as I've seen, all code will have bugs, as experience shows, even security oriented code carefully made and reviewed by experts tends to have bugs, but it is possible (though not as likely) that a small piece of carefully audited code will be bug-free. That's a bit different than the risk of getting hit by a car; it might be more fair to say that you have a "risk" of being bug-free comparable to the "risk" of winning a lottery.