For what it's worth, Drupal is only more vulnerable if you install third-party modules that are vulnerable and don't update those, as well. If you happen to be interested (which I hope you are, since you brought up the subject of Drupal security), see http://www.lullabot.com/node/383 for a thoughtful take on the open security model.