The main point I've been trying to get across is that the fact you have only seen small vulnerabilities does not mean big ones don't exist!

And that [found vulnerabilities per time unit] * severity = [overall product security] is a fallacy in general.

In fact, showing that symfony has had vulnerabilities was a good thing in my book.

Anyway, it's great you've found some framework you feel comfortable with. That's an awesome thing to have.