it’s also not widespread enough to put that theory to the test.

In a way it is in that most large servers are running Linux, which offers a pretty high value target for attackers. That doesn’t translate perfectly to desktop Linux because the attack surfaces are slightly different, but I think it’s safe to say Linux is targeted.