There are always more vulnerabilities than we or the bad guys will ever figure out. They just seem to go on endlessly. The best we can do is hope we figure out the ones the bad guys will figure out and be able to exploit before they do, and then beat them to the punch with countermeasures, which are often pretty simple and inexpensive once you understand the vulnerability.