Two major factors in the likelihood of open vulnerabilities are the frequency of changes, and time to discover vulnerabilities (and develop them into exploits).
While a version under active development is more likely to introduce a new vulnerability... and old version has had more time for attackers to analyze the source and create new exploits. It’s a bit of a balancing act.
Also consider that newer versions may have introduced stronger security barriers that are not present in older versions at all.
And when an vulnerability is found, it’s usually patched first in the latest version and then back-ported to the older versions. So time to fix is usually a bit faster on the new versions (we definitely saw this with Meltdown in Debian, where Debian 9 got a patch almost immediately, and it was weeks before it was back-ported to Debian 8).