Visiting a random website is the normal use of HTTP. With SSH, there might be assumptions of connecting to a trusted server you have an account with and likely own. It's not very normal to ssh to a random server.

> likely own

I don't know how you are using ssh, but most ssh servers that I have connected to in my life, and still do, I don't own. Some of them I barely trust.

The ones I connect to the most often from my personal laptop I don’t physically own but I do pay to rent them and I installed the OS on them myself.

The main ones I don’t own are VPS servers from fairly large providers, or GitHub.

When I said "own", I meant more in the sense of personally administering. It's like how you own a domain, but you're really renting it from a registrar. Rented hardware and VPSs count, as well as other servers/hosts you're responsible for.

I got that, and I'm not saying that it doesn't apply to you, but it surely does not apply to everybody.

This is simply not true

Are we all pretending we have no empirical data on this? How many RCEs has there been in popular web browsers over the past two decades (dozens? hundreds?), compared to how many RCEs there has been in the OpenSSH client (perhaps we can make it one if we include xterm in that)?

It is a real question, because I didn't know about the mentioned ssh attack vector.

Regarding empirical data, that would certainly be interesting, not sure if RCE is the only category one would look at in that case.