It had some CVEs but not many [0]. I think the better argument is that some of the original code is just really hard to read. Click around the repo [1]

[0] https://www.cvedetails.com/vulnerability-list.php?vendor_id=...

[1] https://github.com/coreutils/coreutils/