As I understand, the popular consensus today is that nginx+php-fpm performs faster than apache even with the mpm_event process management enabled?

This was certainly true long ago in Apache HTTPD 2.2. They completely rewrite APR and as of the 2.4 branch it was on par with Nginx.

Some use Apache for a tighter integration with some modules such as PHP resulting is a slightly better security stance with PHP. Nginx makes heavy use of fcgi wrappers and there are a number of foot-guns people create when making their own applications just as PHP itself has a number of foot-guns.

I use both NGinx and Apache depending on what I am deploying and often have HAProxy in front of it on many nodes unless I am just serving static content and then it does not really matter. There is no one correct answer. What people use will depend on what they are doing and also what they are comfortable with. The arguments I have seen about Apache vs Nginx are on par with browser war arguments, cell phone arguments, favorite color and so on. Both NGinx and Apache have their share of design flaws and I have been in long heated arguments with the lead developers of both. People should use what they have the most experience with and can feel reasonably confident that they have done proper due diligence regarding security before performance. This is all unrelated to CVE counts but rather sysadmin PEBKAC [0] issues.

[0] - https://www.urbandictionary.com/define.php?term=PEBKAC