Roundcube regularly fixes security issues, see: https://github.com/roundcube/roundcubemail/blob/master/CHANGELOG.md; a new version 1.7 is in the works
Roundcube has been part of Nextcloud since 2023 (https://roundcube.net/news/2023/11/30/nextcloud-the-new-home-for-roundcube) and is part of their enterprise offering (https://nextcloud.com/roundcube/)
Snappymail (fork of Rainloop) is the fastest of the bunch but effectively dead: https://github.com/the-djmaze/snappymail/issues/1911
That being said, all webmail clients are terrible IMHO as they usually neglect their search features (e.g. fulltext search is slow, you can’t search across folders; Cloudron‘s „virtuall all mail folder“ could help but throws off iOS mail) or have the plugin disease (essential features like MFA are outsourced to a plugin, see Roundcube).
It‘s a sad state of affairs. For my personal mail, I either rely on desktop software / a mobile device or - if I need to have access to my mail the web when I’m not at home, I use Vivaldi Mail in a local Ubuntu Container to which I connect via Apache Guacamole.