It does seem like Ubuntu stacks up well on the 'CVE' scale.[1]
Ubuntu has managed to pull in users with their "just works" reputation. Its actually impressive that they managed to pull such a heist, considering they were a late entrant to this market.
I wonder if I am giving undue importance to CVE reputation. Should I just use an OS that is pleasant to use and call it a day?
[1] https://www.cvedetails.com/product/20550/Canonical-Ubuntu-Li...