The main claim from OpenBSD is "Only two remote holes in the default install since forever".

It is technically true. But it's also selective because they deliberately disable every service by default and don't install any software beyond core.

Once the OS is configured to be useful, we're far from the default install and they would (and have!) refuse to update their motto when confronted with RCEs in those parts.

Which is fair enough! You gotta draw the line somewhere. But that's still being very selective.