This is more of a general question, but can pertain to Ubuntu in general.
Are all distros as secure as can be out of the box or can the distro creators create them insecure?
What I mean is, if I get the number one distro on distrowatch or the very last one, could the creator have a keylogger or malware running right off the bat?
I understand getting the last one on distrowatch is more of a farfetched example, but with less people on it, there will be less people testing it.
Or am I understanding what a distro is wrong?