The only Linux based OSes that are on pair with it are ChromeOS and Android.
A random Linux distribution can be a very minimal one, and can have sandboxing too, which is what I presume what you equate to security.
Linux sandboxing isn't on the same level as Windows 11 Professional, as it doesn't do user space drivers for most stuff, runs drivers in their own sandbox and has critical kernel components running on their own sandbox.
All coupled with hardware attestation zones via TPM, SGX and now Pluton.
Nothing except the last part you said about Windows 11 is true. And the only "critical kernel component" which as of today by default runs on its own sandbox is the protected media path, aka DRM. Anything that could even be remotely interesting is not available on the Pro edition.
Considering Microsoft's general security posture (e.g. check the number of critical cross-tenant and trivial to exploit security issues in Azure - which is unique among cloud providers in their number, criticality and triviality), I wouldn't trust them in the slightest. I know Azure and Windows are different business units, but if nobody in Azure cares about reliability or security, as is obviously the case, I severely doubt that's an organisation that puts emphasis on either.
Win32 apps are now sandboxed.
https://blogs.windows.com/windowsdeveloper/2023/06/14/public...
I know because suddenly I wake up and see that Sumatra PDF Reader is now operating in sandbox mode.
However Linux is not to blame that it's used in idiotic IoT and server configurations.
This sort of citation or "research" is not remotely what the CVE database is for.
I am not playing the citation game, already have enough of it during Usenet and not feeling bored enough today.
The availability of Windows source for partners is nothing compared to how many educated eyes are on the Linux source at a given moment.
Of course none of this matters because the BSDs are more secure than both but they wouldn't pick them over Windows IRL anyways. Why Windows are preferred is a matter of business and not technology. This is a long topic and if you were in Usenet advocacies you know what it's all about. Support, logistics, number of trained people in the market, certifications, so on and so forth. Linux doesn't have an easy fight there.