all software has bugs, most of them get found over time.

no updates, means you are sure to collect known deficiencies.

> Frequency of zero day RCE fixes should not be taken as indication of better security.

true, but lacking an alternative metric, it's at least helpful to gauge the willingness to not ignore problems.