> “Since we began tracking in-the-wild 0-days, Internet Explorer has had a pretty consistent number of 0-days each year. 2021 actually tied 2016 for the most in-the-wild Internet Explorer 0-days we’ve ever tracked̈́”

For anyone else left hanging by this writing: "the most" is four (4) in each of those years according to this spreadsheet linked from the Project Zero Blogspot site: https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtu...

According to this same document, Google Chrome had fourteen (14) "in the wild" zero-day exploits in 2021 :)

The article leads me to believe that the biggest attack surface of IE is actually the usage it its rendering engine by Office. So doesn't it make more sense to update office instead?

Not as long as the ghost of Chrome will.

IE does not support SNI.