Sure, I don't disagree in principle with the idea that a smaller attack surface is better than a larger one, nor with the idea that explicitly enabling things is better than having to locate and disable services you didn't even know were running.

But saying "only two remote holes" gives the impression that all of OpenBSD is secure and that it's the most heavily scrutinized codebase in the world, it's bulletproof, etc.

It's not.

My toaster hasn't had a remote hole in a heck of a long time either, but then again it doesn't do anything other than make toast.

The default install of OpenBSD doesn't do anything, so the fact that it hasn't had a remote hole in forever isn't saying much.