That's true but only as far as the base system goes aka kernel+libc+coreutils+X11. Their slogan makes clear of that, while also strawmanning the issue.
Once you step inside the community repo, the one from where you're getting the real software, it starts shitting the bed worse than Arch. What's the point of bragging that you got 2 remote holes in a long time when the garbage known as firefox has one + a ton of bugs in each major release? From what i see, this fixation on one concept makes you lose the big picture; you do one thing well and totally suck at others, as being the best at everything the first time is the most favorable as being on plus on everything is pretty much detrimental. It affects many OSs and a load of distros as 1 issue is usually enough to make you turn away (at least for me). Just some examples:
>Debian has lots of packages and is stable, too bad that package manager is a total letdown in terms of functionality, performance and default configs. If you want to switch, too bad 100 other distros use it.
>Better use Arch whose packaging is vastly superior, but whoops you don't even get a fifth of the packages you have on Debian, the rest is on a caveman repository from where you install at "your own risk" with a dirty method, breaking the consistency with pacman.
>systemd comes with a rampage and hostages nearly all distros? If you want sysv back, gotta switch to a fork distro that barely manages to stay close to upstream, let alone fix the bugs introduced after the change like Artix with misbehaving AUR packages and Devuan wine32 being broken for months.
The centralization of BSD systems kinda helped them with a solid foundation but the lack of popularity hurt them a lot. At least on lunux you get bedrock and you can use multiple distros at the same time with some caveats so you can pick the good stuff from where you want. On OpenBSD if a package is missing, there is no way of using it besides dual-booting or using VMs with another OS, you can't just unpack a tarball. You could at least use the windows build in wine, but unfortunately it doesn't have it because mah security. For example, on FreeBSD, the 25 year old "server suitable" with "top notch network stack" OS you get the shittiest browser selection in relevant OSs still maintained. You get Firefox and Chromium, and spyware like Opera and Iridium whose last release was in early 2018. No Palemoon, no Seamonkey, no Tor browser, 3 cli browsers even. But at least you can use them in wine; nasty and limiting but it works. It's similar to the philosophy of the gnome devs: if i like it everyone else will, if i don't then everyone will reject it just as me. That's how you end up with another crappy fork whose valued time could be used to do a real and meaningful change.