I agree, measuring "security" by counting CVE counts is a bit like measuring developer productivity by counting git commits, it simply doesn't make sense. But

I agree, measuring "security" by counting CVE counts is a bit like measuring developer productivity by counting git commits, it simply doesn't make sense. But in the grand schema of things, who cares how many CVEs a project has, when it can take almost 2 months for the project to ship updates fixing exploits that happen in the wild already? That's just out of control and unbelievable.