The factors are security design, number of eyes on the product, number of users, and accountability from software vendor.

For example, Fedora comes from an established company. There is a known company responsible for shipping the software, large number of eyes on the product, and a large user base.

Debian is a general purpose OS produced by a community (not backed by a company), by it’s mainstream, and there are so many eyes on it.

On the other hand, an operating systems like QubesOS, is focused on security, but comes from an obscure group of 10-20 developers. There are fewer eyes on it and fewer users. There is no accountability at all. Any one of these developers could disappear tomorrow, with no traces. It could even be a honeypot or has insiders.

Are security focused products such as QubesOS more secure than something like Debian?

The same could be said of Tails, and so on. We have seen encrypted phones such as EncroChat focused on security easily broken (either they were honeypots, or attracted law enforcement to hack them see what their users do).

If you want to be secure, do you use Debian or QubesOS?!