Security patches are typically much smaller scoped than other library updates. Also, Dependabot does not support C or C++ packages so its stats are not that useful for shared libraries, which are most commonly written in C.