All of the world’s servers run Linux. If it was as bad as windows in the early 2000s, it would be known by now. That being said, modern windows is pretty safe too.
When you tack on what it needs to be a desktop OS, you’re tacking on vulnerabilities. Take a point release distro like Debian, and you end up with more out of date packages which adds to vulnerabilities. Also, a web search will reveal decades old issues with Linux used as a server. -It’s not bulletproof, we just don’t hear about it like we don’t hear about Linux much IRL, and it’s something evangelists like to suppress.
If somebody hacks into your Windows computer then you know somebody’s hacked Windows, if somebody hacks a bank or website then you don’t really think about which OS they were running. Go to something like exploit-db and there’s plenty of CVEs for both Windows and Linux but it’s usually in the software.
Booooooooring!!!
