One could argue that the standard Ubuntu/CentOS cloud VM is a real security risk, because it is the most common configuration.
Run Tumbleweed on an ARM server with f2fs? If your malware executes correctly, congrats.
I think we could argue that Ubuntu is a real security risk for a lot more reasons than just it's popularity. It's the Rube Goldberg Machine of Linux distros.