Just a count of CVE, while interesting, I think misses calibrating by how much attention each has gotten. Given its popularity I'd assume much more security research and testing on postfix.