This is arguable. The amount of CVEs is pretty high for a closed-source platform. Several of those CVEs were exploited in the wild for years before being fixed.
Unfortunately this is true for the other commonly-used mobile OS as well.
...which just lends more credence to the notion that you can pretend to be safe and lose your freedom, or you can face the reality that security isn't going to be perfect either way, and keep your freedom too.
I don’t see this being any worse than their competitors, and the long term support of hardware means that when they fix them you’re more likely to get the fix.
Counting CVEs is not a good way of comparing security between software.