Local exploits are much more common and difficult to prevent.
Having a local account implies a certain amount of trust, and it isn't always easy to imagine just how that trust could be violated. Most local exploits involve some sort of elevation of privilege, such as turning a normal user into the superuser, root.
Many local attacks take advantage of a misconfigured system (e.g., file permissions that are set incorrectly) or a buffer overrun on a binary that's set to run as root (known as a setuid binary). In the embedded world—where QNX Neutrino is often used—local users aren't as much of an issue and, in fact, many systems don't even have a shell shipped with them.