Important: I'm not trying to ask here if indeed RHEL is more secure than Ubuntu. This is not an "opinion" question.
Rather, I'm asking, if someone makes the above argument, how would you prove or refute that? I looked at CVE databases but they are full of vulnerabilities in packages, not operating systems. I've compared "hardening" documentation and both operating systems have means of hardening them to a seemingly similar level.
Also, I looked at how popular each OS is - for web servers, in AWS, etc. But what point does that make?
So, how would you deal with this argument?