Are we all pretending we have no empirical data on this? How many RCEs has there been in popular web browsers over the past two decades (dozens? hundreds?), compared to how many RCEs there has been in the OpenSSH client (perhaps we can make it one if we include xterm in that)?

Visiting a random website is the normal use of HTTP. With SSH, there might be assumptions of connecting to a trusted server you have an account with and likely own. It's not very normal to ssh to a random server.