No OS is free of exploits, and exploit counts are not a useful metric. So if, for example, *BSD has a lower exploit count than a common Linux distro, part of the reason is that hardly anyone actually uses BSD, so why bother attacking it?

Just keep your OS patched.