I think the Blaster Worm and other variants that took advantage of that excellent decision were far worse.
https://en.wikipedia.org/wiki/Blaster_(computer_worm)
https://books.google.com/books?id=_TgEAAAAMBAJ&pg=PA60&lpg=P...
A FreeBSD 4.x system with a (modestly) stripped down kernel and running sshd was not only rock solid in 2003, but would probably be rock solid today.
Just to pick one random example.
Nothing was secure in 2003.
a) incredibly far fetched theoretical attacks that didn't work in almost 99% of live deployments
b) local privilege escalation that required a real unix login on the system to exploit
I think if you had left a FreeBSD 4.x system running on the public Internet all of these years you would have been untouched.
You don't even have to be a security specialist to know that there's something wrong with your argument, because you're talking about exactly the time period where OpenBSD --- which is more secure than FreeBSD --- comically started having to change its tagline from "no remote vulnerabilities in the default install" to "just one vulnerability in the default install" to "only two remote vulnerabilities in the default install for a heck of a long time".
Even OpenBSD concedes it wasn't secure in 2003!