Make OpenBSD popular, add a ton of devs, and attack value, and I'm pretty sure these problems will repeat themselves.
I think the second study, which briefly names OpenBSD, does a good job of pointing out that technological changes alone are insufficient.
People were saying the same things about Linux. In the late 1990s and early 2000s. By which time Linux had already become the de-facto go-to OS for web servers around the world. It was, in short, already a high-value target, and yet the apocalypse didn't occur.
In fact, the point of a good portion of the second study [1], p.17-25 is pointing out the flaws that have occurred in the Linux operating system and other existing technologies.
[1]http://www.europarl.europa.eu/RegData/etudes/STUD/2015/52740...
So some bugs will be found in OpenBSD. That's a given. However, it isn't like OpenBSD is never used, or that the people who made it are bad programmers.
I guess what I'm saying is that it would make more sense to me if OpenBSD and Linux were both on the list. As you also mentioned, flaws existing in programs is inevitable, so unless the defect rate, normalized for usage, is significantly higher in one case, it's not good evidence for the quality or security of one over another.