The current story of security flaws in Rust is quite good so far.
That means nothing without knowing who said it. I find it hard to believe it’s anymore secure the C# without security research saying so. It’s a very complex language from what I understand with a lot of moving parts. It’s also dependant on external frameworks in a way that C# just isn’t. If you have a problem with .net there is a company behind it who is responsible. Who is responsible for actix web or seaorm?