You're asking for my opinion, and that's all I can relate, but here's my ranked ordering of things likely to have RCE vulnerabilities, from least to most secure:

* A Java, Python, or Ruby app server

* OpenVPN

* Stock nginx

    ----- starts to get really unlikely right here ----

* OpenSSH

* The Linux IP stack

* WireGuard

One crude first-order comparison is to look at the relative size of the code. More code is more likely to have more vulnerabilities, to a first-order BOEC metric.