So here is my question, how come a decompiler can have "security vulnerabilities"? And more importantly, is there any real-world example to attack decompilers or disassemblers? Or can I perform certain kind of "malware evading attacks" by abusing the decompiler bugs?
I guess that you won't be happy if, while analyzing a malware, a certain pattern in the executable binary makes Hex-rays connect to an evil server somewhere in the World with your account and download a payload on your system...
And, yes, there have been some examples where security analysis software have been pinpointed with security threats. The last I have in mind are on Ghidra:
See also here.