Lack of CVEs for security issues is part of the problem with it. I think SUSE rejected it on the basis of auditing.

While it would be better to run a capability micro-kernel-ish system, you're stuck with Linux for things like HPC. There's no excuse for known exploitable privilege escalations, though and, yes, introducing more opportunity with setuid programs doesn't help. I agree the way such systems are run is unfortunate.