Pretty much. Remember there was the recent Windows, Mac, Linux hacking contest? None of them could be hacked through just the OS itself. It was the 3rd party apps which nailed Windows (Acrobat or Flash video or something Adobe anyway, if I recall). If Linux/Unix apps are direct ports of source code then they could very well have the same vulnerabilities, but with the default user account not having full administrative/root access to the system, the damage is more limited. Windows can do that too, except for the everyday apps (like Microsoft's own Office - older versions anyway, don't know about 2007) that required the user to be an admin to even use some of the programs.