>Because sometimes I see people online who compare the number of CVEs in Rust and C/C++ software, [...]

a rule of thumb i follow is that the second someone starts comparing or talking about the number of CVEs, i just ignore whatever they say next. its hard to think of a more useless metric than "number of CVEs", especially now.