To the point someone has made a talk validating the marketing with the actual reality,

"A systematic evaluation of OpenBSD's mitigations"

> OpenBSD markets itself as a secure operating system, but doesn't provide much evidences to back this claim. The goal of this talk is to evaluate how effective OpenBSD's security mitigation are, in a systematic, rational and comprehensive way.

https://media.ccc.de/v/36c3-10519-a_systematic_evaluation_of...