If we take your logic to the extreme, then there are never any legitimate code execution vulnerabilities in web browsers since the user is not supposed to visit untrusted websites.
Correct, we shouldn't visit untrusted website unless it is from trusted source like banks etc.. There is reason why scamming is billion dollar industry.
