The average software product is worse. Lots worse.
And half the software products are worse than that.
Any organisation that said "let's move fast and break things" is now busy finding out what's actually broken.
Depends. Security is and never was only bug free software.
If no attacker reaches system X you are not as exposed as with your internet facing frontend.