> wthout a JIT, applications can still have arbitrary execution vulnerabilities.

Only on operating systems that allow dynamic executable code.