For the reasons given. Read again, properly. Pay particular attention to the statement that counting CVE listings is a silly approach. Then think, and consider that if that alone is silly, what must counting two sets of CVE listings from entirely different parts of two projects' lifetimes be.

Then read on a find a whole lot of better questions to ask. For bonus points, try asking yourself them about various systems. (-: