Well, there are apparently whole classes of JavaScript malware that Orion blocks but Google doesn't...

This is exactly what I was asking, not sure why my post was downvoted

Along what axis?

Size of security team? Mean time to patch actively exploited CVEs? Availability of source? Etc

Same as Safari in that regard, albeit with a much smaller team (we inherit upstream patches from the WebKit team and publish them regularly, sometimes even before Safari like in the case of patching iLeakage vulnerability).