Debian decided to use exim4 by default, so I figured that it would be better supported / documented. Which for the most part was true. There is no reason why postfix+dovecot couldn't work equally well - I was familiar with none, so I chose what seemed like the past of least resistance.
Exim has had five serious vulnerabilities since 2010; two root privilege escalations and three remote code execution bugs. No confidence.
Agreed. I used Exim4 for a while, but after too many issues, I eventually switched to Postfix, which have been run smooth ever since.