Most of the time in contests like these, the participants already know of the vulnerabilities in the OS that they can take advantage of. They work out the exploit code before the competition, which is why the MBA was able to go down in the first couple minutes of that round; the guy already knew what he was going to do. OSS is generally more secure not because it doesn't have vulnerabilities, but because known vulnerabilities are patched up more quickly. It's not about making linux look bad, it's about having to try to generate working code on the spot rather than being able to analyze and test it prior to the event.