On the one hand, doas is simpler. Less code means less bugs, and lower chance someone manages to hack it and gain admin rights. On the other hand, sudo is more popular, and so has a lot more people double-checking its security. Ultimately, I don’t think it matters - when someone unauthorized gains admin rights, usually it’s not due to bug in sudo or doas, but other problems.