Measuring number of CVEs is not a great metric anyway.

Linux is open source, so people can find more things wrong with it and fix it.

It just means that Linux users and developers are more diligent in finding and removing vulnerabilities.