The point is, they already did. 99% of webservers run Linux. They are all out in the open and hackers love to get their hand on them as they are likely to have mailservers on them and they have a public IP so they can always be reached.

And most of them do not get hacked. And those that do mostly get hacked due to bad passwords or bad website code. I administer one and see the thousands of attacks running up against it daily (most are just attempts to log in with basic credentials). And of course I see the daily influx of updates from Linux.

If a new security flaw is seen, its often quite difficult to use. And with Linux somebody makes a patch before simple tool for hackers are out. With Microsoft products you wait till the next patch day, in the best case critical exploited bugs are patched in days. Also security flaws in closed source products are often easier to exploit and tools to use them are available fast. (Such flaws are often already discovered in open source products by third eyes and testers before they make it to production systems.)

Of course there are exceptions to the rule, like heartbleed. This was an easy to exploit flaw in an often used Linux service and it caused a big turmoil because many where to slow to patch their systems.

Also of course if Linux gets more popular on the desktop more software will be an attractive target for malicious actors and some software may get popular before many people take a look at the source code. But the situation will still be much better compared to closed source systems.

(Also of course more closed source software will be made for Linux then)