One could argue that the standard Ubuntu/CentOS cloud VM is a real security risk, because it is the most common configuration.

Run Tumbleweed on an ARM server with f2fs? If your malware executes correctly, congrats.

I think we could argue that Ubuntu is a real security risk for a lot more reasons than just it's popularity. It's the Rube Goldberg Machine of Linux distros.