That is actually slightly different. I guess I misremembered this. Probably a good question is also how quantifiable other bugs than security vulnerabilities are. Security vulnerabilities are probably the only measurable bugs in that sense, since they are analyzed for root cause and listed consistently. While other bugs can often be explained away and are harder to get numbers for.

In any case the question was about CVEs in coreutils so it's still somewhat relevant.