I wouldn't look at the numbers. There used to be a lot of "scam" CVEs before LLMs, that weren't actual vulns. Nowadays its more popular to collect CVEs, and there is a lot of people scanning with LLMs and reporting without checking (like it was in case of cURL). These CVEs are often not verified by anyone.
There probably is more vulnerabilities found, but the amount of CVEs is not a good metric.
Maybe I'm slow, but tbh this "retro desktops" demos were more confusing than helpful for me. I had trouble understanding what are you trying to show with this - why is there a full desktop with multiple apps, and it takes several clicks to open this web browser. "embed a remote browser" and "embed anything" in the same sentence - anything? Like are they embeding streamed windows 95 os? Is this entire windows simulator streamed (too good quality but could be some streaming svg magic)?. Too much irrelevant details and elements. Obviously I understood after these several clicks and seeing heavily compressed browser window, but I found Hyper-Frame browser to be a clearer demo.
Their position is probably that LLM technology itself does not require training on code with incompatible licenses, and they probably also tend to avoid engaging in the philosophical debate over whether LLM-generated output is a derivative copy or an original creation (like how humans produce similar code without copying after being exposed to code). I think that even if they view it as derivative, they're being pragmatic - they don't want to block LLM use across the board, since in principle you can train on properly licensed, GPL-compatible data.
I needed a simple chat UI for a diy "SMS gateway" (for an extra [nearly free] phone number used only to receive SMS - mainly for registrations and deliveries) and I ended up using Delta Chat that uses your email server under the hood. So I implemented all the logic based on emails... but it would be much better to have some nice looking UI with easy integration.
There probably is more vulnerabilities found, but the amount of CVEs is not a good metric.