And, since Webkit is a development branch, it’s extremely unfair for it to be used as a “target” in this sense. It’s going to have tons of security fixes, because it’s bleeding edge code.

Yes, it's the same engine but only in that they came from the same source. Even in the cases where they were exactly the same unpatched source from upstream, they wouldn't really be the same. E.g I can trivially freeze midori which uses webkit, I can do it to many others. If Midori or any of the others had security bugs, it doesn't mean that Chrome would have it as well therefore they can't be classed as the same.