Linux comes in a wide range of distributions, so it is hard to make universal claims. One area where security defaults need to improve is sandboxing. If security is a major concern, bwrap or firejail can easily provide that extra sandboxing. NixOS and GuixSD make it quite trivial to sandbox applications in a declarative fashion using firejail. An alternative is to use e.g. Flatpak, which gets you sandboxing for free…
I heard about the sandboxing being especially sketchy, thanks for a point in the right direction for mitigation. Additionally, any thoughts on snap? (presently looking into Flatpak)
Containers also provide good development sandboxing. With distrobox you can run many distributions inside your own within a clean and isolated environment.