How do you know there are less vulnerabilities in a smaller package than there are in a better adopted one(usu bigger)? And isn’t it more likely that big packages (they got big I feel due to expanding user-base requirements) get the patch sooner?
Compared to what I could be using, my ideal stack does not have: class loaders, virtual machines, dependency injection containers, web application servers, Log4J, etc.