Because doing enough security reviews to remove all the security bugs gets expensive, and if you use well-reviewed code, it's already been done.