Since Linux is like only 1% of the market as you windoze and mac clowns tell us, no one is going to target us, so I’ll stick with Ubuntu.
Obscurity is not a valid security practice, Joe.
Ubuntu is still vulnerable IF you are using a vulnerable program such as Java or pretty much any Adobe product.
A fresh, clean, fully-patched, out of the box installation of any operating system is going to be as secure as that platform will ever be. Once you start installing “your favorite program(s),” you inevitably introduce vulnerabilities. Few people ever keep a clean core OS.