It would be interesting to see an analysis of the number and severity of Rails security issues as compared to similar frameworks with similarly sized user-bases. I would be happy to be convinced by _actual and relevant data_ that Rails has an unusual problem with security.

But until then, to me, the people complaining about Rails security sound a lot like the people that complain about Windows security. When you have a product that's used by a whole lot of people, then there's going to be a lot of incentive to find security holes and a whole lot of people using the product in sometimes hard to predict ways. This does not necessarily mean that the product is inherently less secure than alternatives, it just means it's popular.