I hadn't heard of that in the wild. But a lot more bugs are caught by vendors than not. It certainly becomes much more of a full time job to patch every bug found individually. (And yes, this depends on more than just rooting, generally. It's the roms that get exploited. But I know you know all this.)