Doesn't seem to have notably more security issues than comparable frameworks, like Django, so I think you're probably overstating it.

It remains popular because it's a pleasant and efficient build common web apps. It's not suitable for every scenario, but it hits a pretty sweet spot in most cases. I certainly keep coming back to it, regardless of the time I spend with other tools and frameworks.