I disagree for exactly the reasons I've stated - "more vulns" doesn't take impact into account. "More vulns" doesn't take who is reporting them into account (internal? paid pentester?). These things matter a lot.

Again, look at projects that pay for vulns. They have hundreds a year - this is a good thing. They come in at a continuous rate.

Counting is pointless.