Unlike Postgres, the average product isn't written in C or C++, so it's probably better. People (even the Rust fans) underestimate how many footguns are everywhere in C and C++. Even the best developers write security bugs not infrequently.

And the average product is solving much easier problems (in terms of low-level programming, which is where the worst bugs tend to be) than a high-performance database.