> 1 bug per ~10KLOC for any project

1 bug per 10 lines -- not kilolines -- is much closer to the actual "bug rate".

You may be thinking "1 serious security vulnerability bug", but in my experience that too is much closer to 1 per 100 lines to 1 per 1,000 lines, depending on the type of application.