2) Who is doing a better job fixing them
Again, see the above discussion of severity. If a vendor is good about fixing the real show-stoppers in a matter of hours or days, but has a huge backlog of fixes for minor things, is that better or worse than a vendor that fixes half of both serious and minor things?
In addition, the question of how fixes get deployed matters too. If a vendor is consistently good about finding a root cause, fixing it, and then saying "we'll ship the fix in the next dot-rev release", is that good or bad? Remember that if they ship a new, updated, more-fixed image every week, that means you get to re-qualify a new image every week....
That also changes over time. A vendor that might have been slow to fix bugs 5 years ago might be completely different today or a vendor that was particularly buggy 5 years ago might be rock solid today and the opposite is also true. Vendors can put out buggy stuff when they had been very stable. Use cases also vary widely and a portion of the software that might be very buggy for some feature set might be completely transparent to you because you don't use those features. The question is widely variable and very dependent on the deployment. Generally, the simpler you build your network, the less bugs you are going to run into. The more features you use, the more likely you are to run into them.