Sure, the EVM may be fine, but the biggest flaws lie in the design of Solidity. Solidity makes it very easy to introduce reentrancy bugs like the one that led the DAO to be exploited. As long as Solidity remains the de facto smart contract programming language, I don't expect overall security of smart contracts to improve much.