tl;dr: Qubes security relies on Xen, which is quite popular. But even Xen has more vulnerabilities than Qubes thanks to a clever design: https://www.qubes-os.org/security/xsa/#statistics.