One ever right? I wouldn't count that as "frequent" - lots of programs in memory-safe languages have more/worse bugs than qmail.

Of course, the existence of one significant not-too-vulnerable C program doesn't really prove a lot either way...