Opendoas isn't immune to security problems, either, [1] but I try to have a policy of trying to use smaller programs and libraries of higher quality and sudo just isn't fitting the bill here. In production systems neither really needs to be installed/enabled (especially just to faciliate a local user to do whatever root can do), and su does just fine for administration tasks as long as you don't do something stupid like leave it logged in on tmux.

[1] https://nvd.nist.gov/vuln/detail/CVE-2019-15901