The train of thoughts here is that less common == smaller exposure, therefore less likely to be a target. Also, your statement isn't entirely true, for example, OpenBSD, albeit not being a linux distribution, is a project orders of magnitude smaller, yet with equal, if not greater, focus on security.