In general and not talking about the Linux kernel, you would be surprised how much enterprise code, written is C, is susceptible to basic buffer overflows from the 90s.

Specially because the people that wrote it use basic C coding patterns and tooling from the 90s.

Or do you think the 70% comes all from highly technically hard code to exploit?