Just don't believe what they say about linux & security.
Open source is as vulnerable as anything, and nobody reads the code for real. Everyone just pretends than someone else must've made it secure because hey it's open source and anybody could do it right?
It takes a fiasco like
Heartbleed for people to actually start paying attention, and then they find out the code they've been relying on for the past 20 years is pretty friggin terrible.
And on the other hand, CVEs are being reported against open source software all the time. Statistically, the bugs are aplenty. How long they've gone unnoticed, or how long they've been privately known (and perhaps exploited) is a different matter.
It's true that there's not much malware targetting Linux desktop users, simply because there are so few of them (and quite a few of them are rather tech savvy and don't run all the crap that *somehow* just got downloaded when they visited some random porn shite on the web, or received as an attachment from some rich dude in Nigeria). (On the other hand, exploits targetting Linux servers & vulnerable wordpress etc. installations are a dime a dozen)
If 90% of the world's desktops & workstations were suddenly switched to Linux, we'd see a massive influx of malware.
It's also worth pointing out that e.g. Microsoft has deployed many exploit mitigations long before they became mainstream on Linux. They might have existed in grsecurity patches or some otherwise hardened distros, but were not adopted for a long long time..
It turns out that real security is very hard to find in the consumer & business space. And nothing will help against stupid users who insist on using terrible passwords and installing & running all the crap they come across.
I'd say take a look at OpenBSD -- I love it -- but even there's a ton of low-hanging fruit. It's not a high assurance system.