Even comparing it to Go is pretty flawed, because of course Go is a language, not a framework, and it has not been tested extensively or attacked extensively, nor have the apps you have written in it. You can expect those apps to have some vulnerabilities you don't even know about as yet, unless you have had a security audit?

Like many projects, Rails is continually discovering potential security problems, though I wouldn't say it is significantly worse than other comparable frameworks/stacks, and some of the flaws they are fixing nowadays are pretty much harmless for normal use (some not, like this one, which is dangerous for the subset of users using these advanced features (probably under 5% of users)).

Pick any other widely used app framework, and you will find a similar history of security exploits discovered, though I'm sure some are better than others. It's fine to say that Rails has worse security than project x, backed up by figures, but saying anyone using Rails is shooting themselves in the foot is hyperbole.

The worst recent issue in rails I can remember is the JSON parsing incident, which also affected some python users. Just as an example comparison, in Golang if you are lazy and unmarshal into an interface or map[string]interface you might end up with similar problems of unintended data leakage, and if you unmarshal into your own struct without carefully checking what you get, you might end up with unexpected nils which only surface much later or data overwritten which was unintended. You're unlikely to get clobbered just as the Ruby JSON parser was, but you could easily introduce vulns without knowing it.

I actually prefer golang to ruby for other reasons, but the frameworks are neither mature nor battle tested, so it's not a great example to compare on security, and neither is OpenSSH.