You should just compare the number of CVEs. Qubes security is stronger even than the one of Xen used in servers: https://www.qubes-os.org/security/xsa/#statistics. Even Snowden uses Qubes.

No single app has access to any data thanks to hardware-assisted virtualization. Last time a VM escape in the modern Qubes implementation was discovered in 2006 by the Qubes founder: https://en.wikipedia.org/wiki/Blue_Pill_(software).