I imagine anyone with any knowledge of the field could see the flaws in the claim that most popular = most attacked.

Lots of counter examples and definitely no clear relationship. IMO its up to the person making the claim to provide evidence.

Just to expand on that nuance then, "attacked" is not restricted to "successful attacks".

The most popular widely deployed software will be the most valuable to attack. That most fail is a function of other properties of the software.