When you tack on what it needs to be a desktop OS, you're tacking on vulnerabilities. Take a point release distro like Debian, and you end up with more out of date packages which adds to vulnerabilities. Also, a web search will reveal decades old issues with Linux used as a server. -It's not bulletproof, we just don't hear about it like we don't hear about Linux much IRL, and it's something evangelists like to suppress.