That's the wrong metric as it ignores the effort people put into securing these ecosystems. Vulnerabilities per kloc would be more reasonable.