The fact they don't enable services isn't what is controversial, it's the claim that they have "no remote bugs in a heck of a long time" on an install that does

The fact they don't enable services isn't what is controversial, it's the claim that they have "no remote bugs in a heck of a long time" on an install that doesn't enable anything. OpenBSD has shipped several vulnerabilities in other network services included in base, including some which would be commonly enabled like FTP and HTTP daemons. Many Linux distros also don't enable services at boot, and use OpenBSD's SSH client/server. They would essentially be just "as secure" out of the box as OpenBSD is, with the exception of RCE vulnerabilities in the TCP/IP stack of Linux itself, which are about as uncommon as those in OpenBSD itself. Giving you a minimal install base is a nice touch, and I greatly prefer it myself. I do not see it as a great security feature, however, since almost (not all, but almost) everyone will immediately install or configure additional services. OS security should be about mitigating exploits and protecting that other software you're running. OpenBSD does do other things to increase security. I just think their tagline is a touch deceptive.