This is an interesting distribution from Mozilla Observatory, which scans websites for security vulnerabilities:
Peaks at A, B, C and D show many sites cluster just above each grade’s cutoff—meeting only the bare‐minimum requirements to bump up one level before stalling.