What really stood out in the article: It took a lot less time for C mistakes to be fixed vs non C mistakes. That's not saying C is great. More significantly most of the mistake based vulnerabilities took over over half a decade to be identified.
That strikes me as a bad thing. A bug that is easy to fix is a bug that could have been fixed sooner. That's exactly the kind of bug that causes the worst issues. Bugs that are hard to fix but readily identified are at least possible to work around.
Not a lot, right? 2400 days vs 3000 days.
That's roughly two years, so I'd say a lot of time is accurate.