I agree with quite a lot of what has been said by ic, except that I would also add that majority of software bugs come from managers pushing timeschedules and more interested in releasing a product on time, than releasing a product that is 100% secure (which may be ...never...)
budgets, ******* managers, marketers etc...they all pull rank on the techies who do the coding.
p.s. just finished watching an interview with an ms chap on the vista audio subsystem...they have a team of 40 guys who have spent the last two years revamping the volume control applet and sndrec32.exe! No, I am serious! Quite interesting to hear of the challenges of making sure all the old stuff still works with the new code, which presumably is why it takes so long, regression testing.