Show me a single person that uses these tools exclusively and does not care about updating their machine.

And even then: ssh does have vulnerabilities. Email clients also usually render HTML, which means they have a browser engine under the hood.