> What platform hasn't had security issues?

That's reducing things too far. "What car manufacturer hasn't had car crashes?" All cars are equally safe?

There's a vast difference between different languages and CMSs and how likely it is for critical flaws to occur. PHP has a horrible track record and continues to surprise us negatively.

Given the % of traffic of the web it serves and over how long, I actually wonder if you have any proof that PHP actual track record in on the bad side because I think it will probably be on the better side actually, same for Wordpress specifically.

That's the wrong metric as it ignores the effort people put into securing these ecosystems. Vulnerabilities per kloc would be more reasonable.

This attitude is what needs to change if we are going to be serious about security. Everything needs to be checked.