Depends on what you're doing. If it's fronting an expensive web-app, then the couple hundred CPU-microseconds needed to proxy a request isn't going to be noticeable...

Caddy can serve 5,000 requests per second per core. I would flip your statement on its head, and say that a minority of people need anything close to that. The few companies that do, can probably afford to keep on top of CVEs for their frontends as well.

That's misleading at best.

Empty request benchmarks are indicative of nothing in the real world.

For any reasonable workload, even serving static sites of a few kilobytes they will be effectively the same.

Caddy's sane default settings (enforcing SSL, and with correct settings to get an A+ on SSL labs) make it the right choice for a lot of deployments