. . "Even if all of the software that the vendor produces opts in to exploit mitigations, such as ASLR, they may use third-party software that does not." . .