Vulnerability counts are misleading metric for security. They do not include the vulnerabilities which have not yet been discovered or created.
It's safer to only use vulnerability counts as a metric for how interesting software is to security researchers.