Another way to say that is that there's no such thing as a "theoretical" vulnerability. There's either a working exploit, or there is not and we can test it. In physical security, though, there are plenty of movie plot threats that nobody has ever actually tried and which are not, in fact, practical.
With software, you can have the computer try millions of times to go after that one crazy race condition. Meanwhile, your average crazy bomber generally has one chance to get it right before everyone on the plane attacks and subdues him.