The most portant thing to remember is that a server is only as secure as you make it.
No OS is 'secure' when you install it. The is a process to go through the to harden a server and protect it from attack.
A couple months ago we have several dedicated server customers running Linux that got hit with the 0 day Dirty Cow vulnerability. These servers typically used a combined 200Mbps of bandwidth, but all of a sudden they were using 2.5 Gbps of bandwidth.
Having security protocols in place, constant monitoring, and a proficient support team is what makes the difference as we were able to mitigate this and patch the servers in a few hours with no ill effects to any customers.
Moral of the story, if it is connected to the internet, it's is not 'secure' and there will be problems. You have to plan for these and know what your going to do, or who your going to turn to when there are problems.
