I would not conflate the tag line about remote holes in the default install with the security features OpenBSD provides [1]. Of which both base and ports benefit from, not to mention the patches for things like Chrome and Firefox to make use of pledge(2) and unveil(2).