You omitted the parenthetical "(though still remains quite small)," which was important. I think the point was: if you were (miraculously, in your view) to produce a piece of software that was free of vulnerabilities, I could safely conclude that you weren't trying to maliciously produce vulnerable software. If you instead produced a piece of software that contained vulnerabilities, it would at least be possible that you were such a malicious actor, so the probability would be higher, if still very small (small-but-nonzero vs. zero).