You are correct; OpenBSD is secure by default. And it's not subjective at all.

The homepage of https://www.openbsd.org proudly states "Only two remote holes in the default install, in a heck of a long time!" if they didn't have the evidence to support the statement, the internet would have forced them to remove it by now. ;-)

Remote (exploitable) holes are the ones we all care about.