I'm curious if you work in the industry?
Linux is used in "enterprise" systems all the time, as are other open source products like MySQL/MariaDB and Apache. My employer and our customers would be good examples of that.
By no means is that definitive that ONLY linux is used - there's a WIDE variety of products used for all sorts of reasons. You say its not accurate to use a broad brush to say OS is wonderful, but likewise it's not accurate to do the same to say it's all bad, or that commercial software is all good.
I will certainly grant that the Log4J exploit certainly demonstrates that the mantra of "open source is more secure because there are more eyes on it" is not quite true.
I went back and did not see where I said anything was bad?
Yes, my company gets most of our revenue from hosting and primarily ecommerce hosting.
Linux sits on about 20% of our servers and honestly if some clients didn't demand it, I would drop it in a second. Linux has by far the highest TCO of any servers we maintain. The last two years have been pretty brutal on the maintenance. Meanwhile, the Windows world in the server market has been pretty much lights out for the last few years. TCO on Windows beats linux in our operation 3 to 1 and that is PAYING full price for windows.
If it wasn't free it would not have any market share at all. And again, I don't care, code is code, but as a business owner paying the bills, the TCO is very important.
And the Log4J exploit sounds cute, but it is a full access breach and there are thousands of servers being attacked every minute as we speak. It took over two full days (50+ hrs) to chase it down in our operation and like I said above it doesn't play that large of a role in our company.
I have a buddy out west that owns a large hosting company with over 10,000 linux servers and about the same number of Windows boxes. He said they have been scrambling to patch Log4J exploit 24/7 for the last few weeks and have at least a couple weeks to go. They also managed to break several of the apps that were being hosted while patching. It is a really bad exploit.
And the last point I want to make is support. If we have an issue with a Windows site, we can actually talk to the IIS programmer group. Try to find that level of support on ANYTHING linux, I know we have not been able to.