That was my thoughts. There is no scaling by project sizes or numbers.
Do the leaps in Ruby vulnerabilities come from problems with Ruby,
problems with common Ruby libraries, hoards of Ruby newbies who can't
code correctly, a high growth rate for the latest fad language, or that
there are now more security researchers who understand Ruby and are
checking these projects? This report tells us /nothing/ of use or interest.