I'd argue that the frequency of security updates points to a fairly immature security architecture - it might be ages before they get anywhere near other suffic

I'd argue that the frequency of security updates points to a fairly immature security architecture - it might be ages before they get anywhere near other sufficiently secure open source projects (although comparing it with linux is a bit like comparing apples and bananas).