The metric Daniel proposes is elegant: if tools are truly converging toward zero bugs, the average age of discovered vulnerabilities should shrink. The fact that curl's data shows no such trend yet is an honest and valuable finding. Finding bugs faster is not the same as finding all bugs, and the gap between those two things is exactly where the utopia lives.