Indeed security researchers appreciate they keeping food at their table, see CVE database.

All of them have had massive security vulnerabilities, and almost certainly (at least Linux and systemd) have many publicly undiscovered ones that are currently being exploited by state actors today.