the problem is that it still comes with a lot of proprietary binaries used for driver interaction (HALs), desktop linux mainly only needs blobs that run on device-specific processors like GPUs or network chips so they're less dangerous (as long as DMA isolation is configured properly) but HALs run directly on the main processor
nowadays it's less bad than it used to be since HALs are supposed to be sandboxed, but considering sandbox escapes happen all the time (literally today lol) that's not a guarantee, malicious code running at all is always bad
