I suspect the gap comes from whether or not you're being used for marketing/IPO bubble driving. I love Fil-C, and its still a small enough project that it doesn't make front page news if a problem with it is discovered. So I think the gap comes in in that they have no incentive to massively drum up the number of security vulnerabilities that they find, by publishing a huge number of false positives that then get quietly retracted

By contrast, when <tool> announces they've found XXXX vulnerabilities in Linux, it makes the news literally everywhere. Even if 0% of them turn out to be real, it doesn't matter - they've already gotten what they want out of it which is the round of coverage about how incredible <tool> is and its the end of the world