The microkernel architecture is theoretically more secure. In Linux (BSD's are better due to simpler code and less attack surface), many, many complex processes run in kernelspace, with high privileges. The Linux kernel has code for like 5 different VPN's, a bunch of filesystems, and more.

So many of the recent Linux vulnerabilities have taken advantage of the code that's present, but not as rigorously maintained,

Microkernels enable you to have that code be executed unprivileged. That means that if the say, IPSec VPN has a vuln, it doesn't pwn the whole system like one of the recent Linux vulns. Of course, there are userspace/non kernel implementations of wireguard, wireguard-go is used a lot, but them you sacrifice performance. Plus, it doesn't apply to things like device drivers.

Of course, this is just a theoretical benefit. I know projects like sel4 are designed with security in mind, but I'm not sure about Hurd in particular.

In theory, the microkernel design would allow for all device drivers to be built as servers working in user space, but today most drivers of this kind are still contained in the GNU Mach kernel space.[26]

from: https://en.wikipedia.org/wiki/GNU_Hurd

The linked source is really old though, so I wonder if that statement is still true.