The Linux desktop technology stack lags behind Windows and macOS when it comes to security. The causes are both technical (see this comment [1] for an overview) and non-technical, often stemming from a fragmented development model where there are no clearly defined security boundaries. For example:
- There is no real concept of base system because distros are usually a patchwork of software from diverse sources. This means stuff like proper secure boot is not really feasible on any distro (although AFAIK the systemd/Fedora people are working on it with signed UKIs and immutable OS images).
- Some features that could live in userland for improved security are instead implemented in the kernel, while both Windows and macOS generally keep moving exploitable features like font rendering to userland.
- Distros often disable or disregard security features such as SELinux or mitigations like CFI.
Here [2] is a more detailed article examining the lack of security of Linux desktops in case you're interested.