Linus doesn't view security bugs as a special category of bugs. So he doesn't prioritize them they way most infosec people would like them to. The lack of a strong security advocate in their leadership is largely the reason why Linux isn't the best example.

The other big reason being that it's a giant blob of C and a large attack surface.

All of these factors could be easily avoided or simply don't exist for an Ethereum contract developer.