Most of those exploits are software/driver vulnerabilities, and AMD has plenty of their own. Like when Threadripper drivers installed an out-of-date web server running with SYSTEM privileges, or when a series of PSP and BIOS bugs let an attacker escalate from VM guest to control of the PSP and BIOS persistence. If you're not finding vulnerabilities in your software, you're not looking.

Intel is in a lot more verticals than AMD is - networking, storage, etc - and all of those get their own CVE number. But that's a more nuanced approach than "big number bad" isn't it?

Specifically, Intel is finding a lot because they're doing an enterprise-wide initiative to lock down their IPs. Is AMD making the same effort, or are there more vulnerabilities in those GPU drivers or in the chipset drivers that they're not looking for? After all, a year ago they were at the stage where they were installing an out-of-date Apache instance along with your motherboard drivers... doesn't sound like security is priority #1 for them.

Again, low number sounds good. But if you're not looking, it's actually not good.

And researchers are not looking on AMD much either. AMD is less than 5% of the server market right now, you get the big headlines from finding vulnerabilities in Intel now, not AMD. Give it another 5 years and there will be more scrutiny on AMD's hardware/software.