I'm not trying to knock either Ghostty in particular or new software in general. But the kind of "open season" phase you're referring to is basically the same point I'm making: new software still has to go through the phase where they work through their security model, have it probed by researchers, and earn their reputation.
I don't think there are larger lessons to draw from that occurrence. A reputation for security has to be earned, and Ghostty hasn't been around long enough for that. From my vantage point it's on track, but only time will tell.