You believe the security of systemd is strong, and that CVEs are a sign of use and maturity, then you’re saying ~2 CVEs per year on average is compatible with good security.

I understand you believe this, but I don’t see how it’s rational.