Well. The principle of Linux was and still is to give tools and have users use them. It gets out of the users way to use them. One can always use firejail or other sandboxing solutions to do that. Chrome itself is a security nightmare, always with the mic on and listening. Microsoft and Apple also have CVEs unattended. Binary checks before starting a program? Why I have a package-manager that does the checks. Untrusted binaries are ususally installed with local user rights in a seperate path or best, not run at all(never needed to turn to some website offering tools since moving to linux aeons ago). Not all distros use Flatpack or Snap, and I hope it remains that way regardless of how fiercely Canonical is pushing for it. Granted, the out of the box security provided by Linux as a Desktop OS is behind the Windows/MacOS one;Only think of the non-existing firewall rules on a fresh Ubuntu installation. But I think that is ok, because installing Linux is a conscious decision, unlike using a preinstalled Windows or MacOS. So, if you do that move from one OS over to another, the user should read up and not expect the community to hold their hands without asking questions.

Not everything is perfect, yes moving the toolchain would be nice, but then again, most a community run projects, so the user needs to know about locking their basement as well. Hence the audience is/should be more technical minded anyways.

IMHO another post about comparing apples and oranges leaving out second-level effects. Just an example: Looking for CVE-entries https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=MacOS , https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=Linux , https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=Windows . We see that MacOS has the fewest and Windows the most CVEs. (So it doesn't matter that Microsoft closes the CVEs quickly and Debian might take some time (haven't really run metrics on that one), there is a huge attack-surface on Windows, compared to Linux and new once have to pop up all the time :D) That isn't looking into severity, because a chaining of medium CVEs might also lead to a compromise as well ,and not everything requires system or root. User might be fine as well. I see a reflection of favoured OS. Only few people use MacOS (some artists, companies streamlining their assets for maintenance and rent,etc.). Windows, on the other hand, was always the big dog on the desktop market. Naturally, maleware authors focus on the biggest market.