Why do you think Ubuntu is dead last among Linux distros in security? From my experience, they patch things quickly and inform about security issues promptly.
2. Their packaging team screws up packages regularly.
3. They have insane defaults of many package configurations.
4. They tend to do things their way rather than the standard way and come up with their own tools rather than using standard, well tested tooling / packages.
I could go on and on, but it's not a distro I'd ever let run on one of our servers, we used to run 100% Debian until CentOS 7 came out and in our eyes left it for dead when paired with the correct yum repos.