Sure, the EVM may be fine, but the biggest flaws lie in the design of Solidity. Solidity makes it very easy to introduce reentrancy bugs like the one that led the DAO to be exploited. As long as Solidity remains the de facto smart contract programming language, I don't expect overall security of smart contracts to improve much.

My point is that if 60 million dollars were stolen in Eth without no recourse that would permanently tarnish the name Ether. Nobody would care that the DAO did not represent the whole project, the fact a huge portion of the economy was pushed and then destroyed would ruin the brand entirely.