Well, it is not just about the fact that SDF switched to Linux and then back to NetBSD.
First they switched to Linux on x86-Hardware and then to NetBSD on DEC Alpha hardware.
It is safe to say that the NetBSD/Alpha architecture is less popular in comparison to Linux/x86.
That means that it is much easier to get ready-to-run exploits or exploitation-meta-frameworks for Linux/x86 than for NetBSD/Alpha. Sure, there are probably shell-codes readily available for NetBSD/Alpha, too - but script kiddies or economically thinking attackers are not able or don't want to invest extra time integrating the shell code into an existing exploit (or creating one from scratch).
Thus, it was a kind of more security through more obscurity effect.
Besides, SDF provides shell access to pretty much everyone - and shell access is quite hard to secure against attackers. On all systems are local exploitable vulnerabilities much more common than remote ones. See e.g.the recent kernel.org break-in.
Plus, at 1997, techniques like auditing, virtualization, compartmentalization or mandatory access control (MAC) were not available/mainstream in common Linux distributions (as well as in other Unix systems).
Conclusion: SDF has by definition a very large attack surface and having switched to an 'obscure' system architecture seems to have had helped them in 1997.
(PS: I am ignoring other possible influencing factors, e.g. different degrees in familiarity with administrating the one system vs. the other, learning from past mistakes in system administration or something like that.)