I would argue that opinionated design and to a certain extent "magic" on the whole can reduce the amount of security problems. Compare something like rails wit

I would argue that opinionated design and to a certain extent "magic" on the whole can reduce the amount of security problems. Compare something like rails with sites that are developed in vanilla PHP. In my experience it is rare to find a vanilla PHP site that doesn't have a whole menu of vulnerabilities which can be found within ~10 minutes of prodding. Granted this might mean that each site has different vulnerabilities that have to be found on an individual basis rather than some vulnerability that can be attacked by spray and pray tools. Rails will give you some very sensible defaults that even inexperienced developers get benefit from, just having template HTML sanitised, CSRF tokens and parametrised queries by default stumps a whole load of attacks that you would otherwise have to consider every time you build each web page.