Some vulnerabilities are incredibly complex and are identified not through the code itself but through various attack chains being strung together.

Also there are likely a lot of vulnerabilities identified but the work required to fix them vs the complexity to exploit them means they don't get fixed.

I'd wager we don't have an issue with identifying vulnerabilities but the ability to fix them.

I work in security consulting and identifying vulnerabilities isn't the difficult part its actually fixing them and fixing the ones that have valid exploitable attack chains that matter