This sounds like a plausible factor but on the other hand, people who use Tor might be more security conscious and/or tech savvy, frequently run in a sandbox VM

This sounds like a plausible factor but on the other hand, people who use Tor might be more security conscious and/or tech savvy, frequently run in a sandbox VM - and those unpatched vulnerabilities might get burned sooner if used on them. Any evidence or data would be interesting to see of course.