The moment you start patching qmail you're not running qmail any more. None of the CVE numbers are meaningful to your custom-patched qmail. qmail was good when

The moment you start patching qmail you're not running qmail any more. None of the CVE numbers are meaningful to your custom-patched qmail. qmail was good when you could use it in its default configuration. Unfortunately, very few sites could (much less still can). Which brings us to the question of who you trust more: The maintainers of a full-featured MTA who have maintained their software for 20 years or some person's patches to scratch their itch before moving on and never touching it again?