Reentrancy is the bug that started it all. The 2016 DAO hack drained roughly $60 million in ETH using exactly this flaw, and a decade later it still shows up in fresh audit reports and post-mortems.