I used to work on the security team at Citrix. It's a very competent team that does proactive security auditing, threat modeling, pen testing and developer training as well as response.

However, the "Go To" products (until a year or two ago) were part of Citrix Online, which operated independently of the rest of Citrix.

So I don't see this as a reflection of the security of Citrix's core products.