The JVM has at least a security model/system. Something the Ruby MRI VM lacks. i.e. a ruby program is never in a sandbox.

Using the JVM with JRuby or Ruby MRI as webserver are reasonably equivalent in security footprint. And in recent history MRI has had really worrying security issues too e.g. https://www.ruby-lang.org/en/news/2013/11/22/heap-overflow-i...

I mean security can always be improved but you are comparing apples to apples and declaring one of the two to be an orange without decent evidence or support.