[jpatokal]

And you're proposing to get a less misleading metric for undiscovered or uncreated (!?) vulnerabilities how, exactly?

[postmodern_mod3]

Maybe graph the rate of vulnerabilities discovered vs. LoC/files added?

It's safer to only use vulnerability counts as a metric for how interesting software is to security researchers.