"I am well-aware of the fact that people do not update their programs, and if your goal is to attack these low-priority targets in insecure environments, then by all means, learn BOF. "
This is a very absurd thing to say. Do you not see the results from pwn2own every year? Just this year there was one lone man who could get code execution on any box, completely bypassing all protections, for IE, Firefox, Safari, and Chrome. I can promise you this guy did not stop learning, just because "they're becoming uncommon". With your attitude you won't reach a stage like this.
Yes, alone, the protections are useless and when chained together it can be a pain in the ass to bypass, but it's still possible many times. Have a look at this case:
vreugdenhilresearch . nl/ms11-002-pwn2own-heap-overflow/
ROP gadgets and pointer leaks are not all there is to bypassing protections, dude. These protections are here to help reduce the risk of the overflow, but the overflow has already happened. More protections may come, but, many times, they come with new ways to bypass. When some of these protections were first introduced, this left most people at a stand still. But eventually, with persistence, people found a way.
As long as someone answers no to the question, "Do you write perfect code?", it will always be worth learning about BOF's. Idiot programmers are still out there. And that includes us, too. It's not easy to write secure code.
What worries me the most is that you say people should not be learning buffer overflows. BOF's are not only useful for exploiting, but they serve as a good model for security concepts. They also are a stepping stone onto more advanced things such as kernel bugs.
Yes, BOF's may have decreased in numbers over the past years, but that's with every vulnerability. In fact, why bother with things such as SQL injection in that case? They are getting harder to find.
