I believe what they are saying is that they looked at historical security updates and saw what percentage of them would have applied. Because it has less code,

I believe what they are saying is that they looked at historical security updates and saw what percentage of them would have applied. Because it has less code, there are security updates that wouldn't have been relevant. That seems like a reasonable approach to me, if that was their methodology.