Most of the software on a typical desktop Linux never runs on servers, so we cannot uses Linux's high level of use on servers to conclude that it is safe to use desktop Linux.

Also, at organizations like Google with a good reputation for security, the machines running Linux that are connected directly to the internet are very carefully configured to minimize attack surface and most of the Linux machines are connected only to protected internal networks.

And Google has an internal team of Linux kernel maintainers that do not for share most of their work outside Google.

Not any more. Not with a new LPE being discovered every week. Containers are dead, user accounts are dead, VMs are on shaky ground. We're currently getting the same level of security from Linux that we got from Windows ME.

Aaaand now we have sshhole: you can just log into containers by typing a password longer than 256 chars. Proving my point. The CADT development model (a.k.a. open source) cannot produce secure software, period.