Postfix has a far better security track record. Exim has a steady stream of CVEs.