Every bugfix is a CVE. Even if it is maybe not a security problem in first place, but it might be one in the kernel context, so everything is a CVE. Also other CVEs from other applications, open source or not, doesn't have to mean that much. You have to see those database quite critical. Especially if you need very esoteric, almost magical methods to exploit.

When the people of the Linux Kernel started flooding them, because every bug is a security problem, those Database providers were and are very happy. It makes good money, those data is seller from other providers to companies. And now you really have to use their service, because the kernel have soooooooo many security problems! It is not like developers or security teams are happy about this shit. But if the senior leaders insist on use those CVEs, you don't have any choice. And it is not that unusual, that it is not needed to address them.

The Linux Kernel can provide and provides more security when you use them. It is the decision of the distribution if they want to enable selinux or apparmor, enable kernel options, which make your system more hardened with memory encryption, page poison or kernel lock down and and and. Since this is only the kernel, the userland can provide more features, which some distributions also enables.

The way you can elevate applications and define special rights for the usage of devices or OS functions, is incomparable to standard Windows. Would only user, group and rwx exist, they wouldn't be any lxc, podman, docker or whatever today. Windows does not the same now. Windows does it different and can't do some things regarding elevation of rights and their restriction by design.