Yeah, I haven't personally. Might be beyond my expertise but I have heard this from multiple sources (devs). I think it's generally understood to be so, it's just that some say that the configurations are "opinionated".
I did some comparison of the source code of both and posted in this thread. Note that a single line of buggy code is enough to end up with a remote backdoor, intentional or not.