Counterexample: the Debian bug of 2008 lingered in the code base for years before being detected, but the fix was still a one-liner (as was the original bug).