How do you expect Mozilla to make enough money from just Firefox to survive if Google ever decides to stop paying them for being the default search engine?
It could very well be an actual reachable buffer overflow, but with KASLR, canaries, CET and other security measures, it's hard to exploit it in a way that doesn't immediately crash the system.
I don't think it's about trying to handwave away the achievement. The problem is that many AI proponents, and especially companies producing the LLM tools constantly overstate the wins while downplaying the issues, and that leads to a (not always rational) counter-reaction from the other side.
> Microsoft doesn't have a very good track record with security or privacy.
That's a very unfair assessment. In many areas, Microsoft services and Windows are better protected than most alternatives (e.g., disk encryption, virtualization-based isolation,...), and security is taken pretty seriously for new products.
That's hard to implement, because typically, constructs like this will be the result of various previous passes (macro expansion, inlining, dead code elimination,...), typically it's not written by the user directly.