So it looks like Parity.io were using buggy code is the problem in this case, not Ethereum?

The platforms being developed upon ETH have so many moving parts they're highly vulnerable to exploits.