I hear what you are saying, Brave is a fork of Chromium. True story.

The vulnerability example you gave however effected Chrome, not Chromium. Chrome is based on Chromium, not the other way around, believe it or not. Hence Chromium also hasn't had a vulnerability this year either, which is why Brave hasn't, or any forks of Brave for that matter. Why Chrome takes open source software and modifies it to generate on average a vulnerability every other day is anyone's guess, but ultimately unrelated to this topic. It's corporate-owned proprietary software, of course it's vulnerable!

You maybe right that this Chrome vulnerability did effect both Chromium and Brave, but without any documented evidence (CVE's), and without being a qualified programmer, I think it's far fetched to claim that this is the case. Please provide (actual) evidence to the contrary and I'd be happy to reconsider my opinion. The brave merge you referenced isn't tagged, labeled or referenced as a vulnerablity in any way, shape or form, as far as I can tell. It just confirms that when chromium updates it's stable branch, then brave follows suit, as you would hope and imagine. Now does it make sense why people use open-source software to stay safe and not proprietary closed-source software?

Correction: Here