I agree with this to an extent, a complete novice probably shouldn't take this sort of leap without understanding the configuration involved in securing down a Linux box. I wouldn't say it's out of the reach of most people familiar enough with Linux, though.

Regarding security programming, etc., I expose as little as possible to the world. Of the services that I do expose, I'm relying on pre-packaged software and the maintainers of Debian to keep it patched for me. I trust that those people mostly know what they're doing, and any code I write will mostly just be for internal automation.