A million websites is a lot. I'd be more worried if 10% of the top 100 were unsafe.