security vulns are not in and of itself (themselves?) indicative of the usability/quality of the software.

If someone were to finger all the nameservers in the world, I would bet that BIND has a large user share.

A good alternative is NSD from the team that also makes unbound.