OK so weirdly, he claims PHP is dead but actually specifically says he's comparing two frameworks. So, does that mean because Rails recently had a heap of vulnerabilities, Ruby is automatically insecure?

No.

There is a difference between a language and a framework. That Flow is yet another attempt at an "Enterprisey" mvc framework for PHP is a fault of the developers of Flow, not the language it's written in.