Very excited for COSMIC here 
I think we can go by process of elimination:
- C++ has way more footguns for developers compared to C (example), especially for projects that lack proper documentation.
- Mutter is definitely actively working on security (example), and has clear documentations and guidance for developers (mutter docs vs wlroot docs).
- Finally, because of RHEL, Mutter also gets more eyes on it usually, leading to quick detections and fixes (example)
Do I think this means we should recommend non-wlroot wayland compositors only? I am not sure. But if we go by the idea of leading users away from potential footguns rather than the idea of only informing them of clear-cut, well-defined footguns (sounds funny 
), I think its fine to recommend non-wlroots compositors (mostly Gnome honestly).
Its also tied in my mind to the idea of how PG does not recommend 1500 distros of linux, and instead only recommends a few. Similarly, we should just recommend one (preferably Gnome) and not try to cover all compositors/DEs/whatever else.