[nvy]

OpenBSD isn't materially more secure than Linux, these days.

They've shipped several RCEs over the years, in software included in base, but because the software is not enabled by default they don't update their security slogan.

It gives the impression of an OS that is free of vulns which is not true. The "default install" is not useful for much as IIRC it only has ssh enabled which means their claim of only two remote holes in $time_period is really just a claim against their TCP/IP stack and OpenSSH, not the entire OS.

It's deliberately misleading.