Mostly not. A lot of the attack surface has not been implemented yet. :-D

When it has, fewer services are running at startup.

Generally, it doesn't copy the atrocious early security default configs that were later changed.

Don't believe it ships with an old browser or email client, so ~60% of potential issues gone right there.