How so? A PHP runtime running WP on .NET needs to be bug-for-bug compatible with the real thing (and I've heard early PHP APIs aren't exactly a paragon of API design).

Also, why would php-on-net be updated more often than one of the most used runtimes on the web?

If only the .NET version would use proper security (no permissioner to modify files, sandboxed plugins, ....) then yes. But that would be a rewrite.

Otherwise the .NET version only remedies vulnerabilities in php and not those in WordPress or its plugins.

True, I've been noted, for example, about issues with openssl library, which is updated with every update of PHP ... while Peachpie uses the one provided within .NET which might be more frequently updated by Windows Update.