aurocha As to the @GrapheneOS comments regarding Debian, I do believe that they do a lot of backporting in order to mitigate eventual issues that arise during the lifetime of their distribution, although I understand that they're being applied to an ancient, probably insecure, base. I don't have the expertise to have an opinion but would like to know more about it.
Debian has traditionally been seen as one of the most secure Linux distributions, because they have taken security issues very seriously. Back in the days, many Linux distributions did not bother much about security issues, and even in more modern days, some popular distributions such as Ubuntu (and derivatives) only issue security fixes for a small subset of their packages, leaving all the other unpatched even if security issues are known. Debian took it far more seriously, and backported security fixes to a much larger scope of their packages, and did all this in a reliable and timely manner. Debian has also always been entirely transparent about what security fixes they release, and for what packages, which has contributed to them being a preferred distribution. Debian was also first with reproducible builds, to further raise confidence in the security of the system, and most other Linux distributions, apparently including Fedora, do not have reproducible builds even today.
However, the security landscape does change. And by today's standards, merely backporting security fixes is no longer considered to be secure enough. The set of security issue that gets fixed will not be complete. Debian has also not applied almost any of the more modern hardening features that have been developed. The attention has started to shift towards Fedora and especially the Silverblue and Secureblue versions of Fedora.
And for people with specific security needs, such as activists, Tails and QubesOS have instead been favorites, for a long time now, since they enable compartmentalizing ones life into security domains.
aurocha Debian is massively used on servers. Google has their own patched flavor of Debian. I suspect the observations might be related to the desktop itself, rather than the base OS, but I might be wrong.
No, I certainly would feel very uncomfortable running Debian or even Ubuntu on a server. Most modern servers today relies heavily on virtualization, and thin containers that doesn't really have any OS at all, just a single application bundled with the essential libraries it needs. It makes QubesOS look legacy in comparison. They can keep security much tighter that way, and also enable load balancing, redundancy and 100% uptime guarantees and many other things a regular OS cannot.
With that said, although security vulnerabilities are common, as long as you are not a specific target, ie are not running a server or other service exposed on the internet, and are not an activist or other attractive target, getting your system actually exploited isn't that common. It is far less common than one might get the impression from at forums like this one, where we take security extremely seriously. Most desktop computers running Windows or Linux never gets hacked, as long as security updates are installed, and the user has basic security hygiene, that is, do not follow untrusted links, do not install random untrusted application, do not open random email attachments and so on.