We have kept hearing about security issues on Flash for so many years now, and even now there are many zero-day bugs that are being discovered in this piece of software.

I find it surprising given that Flash has been around for at least a decade and has presumably been worked on by very talented programmers. They have had plenty of time to work on discovering fixing most of the security flaws.

Is there a set of reasons why Flash is insecure, or is it just as insecure as other platforms but highly sensationalized? Are there any lessons to be learned from this for other software devs out there?