Article note: Shown exploit isn't root (or even arbitrary code execution), but they did cobble a little drawing-a-user-controlled-graphic PoC by doing ROP in the userspace... less than 5 hours after release.
Most software today is very much like an Egyptian pyramid with millions of bricks piled on top of each other, with no structural integrity, but just done by brute force and thousands of slaves.