The default settings of many Linux distros don't enable major security features. For example, on Arch Linux, microcode updates must be configured separately and

The default settings of many Linux distros don't enable major security features. For example, on Arch Linux, microcode updates must be configured separately and most users likely skipped that step. Also, X11 has really poor separation between processes. Any desktop application running in Xorg can keylog all user inputs. It is possible to build a secure Linux installation but it requires a lot of careful OS knowledge and the discipline to only use a small set of software with established provenance. And probably disabling Javascript.