Writing secure code is always harder than not, and developers love to take shortcuts.
For example, many of the IO functions like gets() are no longer valid in C11 exactly because how unsafe they are.