Their maintainers have always be among the most responsive to security reports, so at least for this reason I wouldn't encourage you to switch to an alternate solution. The component might have historical problems but they're methodically being eliminated by rigorous people. If more software was maintained like this, we'd progressively converge towards bug-free code.
It's been the experience over the last 8 months on the security list, with some reports coming in the same week from up to 13 different sources, each not knowing someone else already reported the bug. A significant portion of bugs founds by LLM arrive as duplicates, so keeping them private doesn't protect anyone and makes it much more difficult to get them fixed.
