Hopefully the recent flurry of Linux vulnerabilities will remind people that monocultures are bad for security. Replacing a Windows monoculture with a Linux monoculture may be a small improvement but does not fix the problem. Both systems are well past the complexity level where you can guarantee no security vulnerabilities.
A local privilege elevation bug combined with a sandboxed arbitrary-code execution bug in some widely deployed userspace software lets an attacker take complete control of all of your infrastructure if you have a single OS. If you have a mix of different systems, it is much harder to build exploits that will work on all of them.
This is part of the reason I strongly encourage digital sovereignty movements to focus on small, composable systems rather than huge monoliths. If every company and government service is running a different mix of modular systems, it’s much harder to create a portable attack that works on all of them.
