Linux comes in a wide range of distributions, so it is hard to make universal claims. One area where security defaults need to improve is sandboxing.

If security is a major concern, bwrap or firejail can easily provide that extra sandboxing.

NixOS and GuixSD make it quite trivial to sandbox applications in a declarative fashion using firejail.

An alternative is to use e.g. Flatpak, which gets you sandboxing for free via bwrap. But I am not a fan of application images that bypass package management.