I’m honestly wondering who you’re responding to with this. Of course the vulnerabilities are software. Why would they be hardware? OP talked about how he couldn’t update the software to allow him to access an app he wanted to use. They’re on iOS, and you’re talking about Android. Do you think developers don’t debug their software at all? 99.99% of devs aren’t intentionally creating vulnerabilities in their software. We’re not talking about web development?