I'm using both Sinatra and Rails, but I would not advise someone to switch to Sinatra because Rails has more "fixed vulnerabilities".

Around me there are many times more Rails apps than Sinatra apps. I do believe that the increased exposure of Rails makes it more likely to detect vulnerabilities over there.

To be fair, this attack is more based on form parsing and constructing SQL statements from fields, not necessarily ActiveRecord itself.

So you think that if you write everything from scratch it won't have any flaws? Of course it will have flaws, you just won't know about it.