While you're obviously correct to imply that languages/frameworks have different levels of security the problem with that proposition is how does a prospective

While you're obviously correct to imply that languages/frameworks have different levels of security the problem with that proposition is how does a prospective user of the framework assess the level of security it provides? You could argue that "big, enterprise" systems are likely to be more secure, but experience with things like Oracle databases around 8/9/10 would indicate that's not always a good measure. You could argue (and people do) that the framework being open source is a good thing, or a bad thing. So absent that information how would someone factor that into their choice of system?