as there are many many CVEs

Did you even read your own link? Four server CVEs this year is close to nothing. Windows and Linux patch like 40 a month. Also none of those vulnerabilities would provide unauthenticated access to any data. Pretty much 99% of all published CVEs only work if you already have some access or privileges on the system.

Well, because it’s wrong. Graphene fanboys usually just repeat what the lead devs says. This user’s comments can be found almost 1:1 in the GOS forums from the official account.