Linux

Yeah, but the level of security complexity rises once the Internet gets involved, and risk goes up by an order of magnitude once you have a server storing personal information (even temporarily). Once the random-person-in-Nebraska whose project it was pulls out, what happens to the cloud data store the sync was using? Can you guarantee it was wiped and won't come back to haunt you years later?

The more popular software tends to have a bus factor larger than 1, so there's some continuity for maintaining infrastructure, including data stores.