I personally strongly assume that the reason is that the firmware of well-known brands is a lot more static than CyanogenMod. Finding security holes takes a lot

I personally strongly assume that the reason is that the firmware of well-known brands is a lot more static than CyanogenMod. Finding security holes takes a lot of time and if it is updated too often it can easily happen that the bug has been fixed/new bugs have been introduced. Additionally, if you want to write an exploit to prove that the bug is indeed exploitable, you are often back to square one if even some small details change in the firmware. Additionally finding bugs in the firmware of well-known brands carries a lot more prestige than finding bugs in some "hacker project". Sorry, but the more complicated to update an firmware is, the more potential danger lies in finding a similarly dangerous bug. Since CyanogenMod is by definition much easier to upgrade than some not-anymore-supported hardware vendor firmware, the conclusion should be clear.