I don't think that means anything
1. There are way more WP sites than Joomla and Drupal and they are overwhelmingly blogs. So people are more likely to blog about getting hacked and run more sites. Ergo, super high number of reports.
2. Drupageddon was a bloodbath. Most public facing sites that didn't get patched were hacked within six hours. I went 4/6 and got lucky on the one site that was e-comm. So that was huge press. [
fireroaddigital.com...]
3. How much security "chatter" there is on the web is a function of two things: the number of exploits and the seriousness with which people treat them. It's essentially like any crime stat - it's a function of the number of crimes committed and the rate at which those crimes are reported/prosecuted (depending on what sort of stats you're looking at). In general, I think Drupal treats security more seriously in the sense that the security team issues notices for *any* module that has a known exploit. Wordpress typically only issues security notices when it affects core, not every plugin. But plugins are the main attack vector typically.