It's written in C, which is part of the problem. I'd be very interested in a similarly-featured webserver (reverse proxy, mostly) which is written in a memory-safe language.
Greenfield writing a new safe reverse proxy that works within a magnitude of performance of something like nginx is a monumental effort. Not to mention the chicken-and-egg problem of how nobody will trust it until it has significant usage which it won't get until some people trust it.
Caddy can serve 5,000 requests per second per core. I would flip your statement on its head, and say that a minority of people need anything close to that. The few companies that do, can probably afford to keep on top of CVEs for their frontends as well.
Empty request benchmarks are indicative of nothing in the real world.
For any reasonable workload, even serving static sites of a few kilobytes they will be effectively the same.
Caddy's sane default settings (enforcing SSL, and with correct settings to get an A+ on SSL labs) make it the right choice for a lot of deployments
https://github.com/mholt/caddy/issues/1204#issuecomment-2781...