It’s a rare piece of code that never requires patching to fix some flaw or other that allows users to do what they were never meant to do.
Exploits can be as simple as checking out plain text password files in an unprotected directory, or inputting something akin to the Konami code. It can be spamming a password field until it breaks, or writing more data to a memory buffer than it can hold.
Hackers have been hacking since before the first computers were networked together with bits of string and sticky tape. Generally, this involves poking things until they break, and then poking them again. Occasionally, it involves the careful inspection of code to see whether there are any obvious flaws that developers have missed. This is one of the great arguments both for
