One way security analysts can glean insight into security holes is through security patches.
Patches are effectively the exact description of a security flaw and its addressed fix.
One assumption that patches make and is clearly true based on the fact that patches in fact do work, is that programs are modular.
Modification of a single portion of code does not necessarily impact the syntactical representation of the rest of the program.
From this assumption, it follows that we can expect that we can extrapolate the flaws and changes across two versions of a program simply by looking at their difference.
If a program were not modular, the difference would be too widespread to come to an understanding simply from their binary difference even though the programs are functionally, semantically, similar.