I can see:
Only two remote holes in the default install, in a heck of a long time!
I understand the concept what are they pointing out, since other OSes have much-much-much more remote code execution holes historically, smbfs, etc.
I even found the second hole they are pointing out: https://lwn.net/Articles/225947/ - CORE-2007-0219: OpenBSD's IPv6 mbufs remote kernel buffer overflow
But the Q: what was the first remote hole they are pointing out?