Operating systems that are locked down like iOS or ChromeOS remove one major vector of compromise, which is people accidentally or being tricked into installing malicious programs. However, explicit installation is different than an exploit, which can be triggered by a text message or merely visiting a webpage. For instance, there has been a string of iOS exploits related to iMessage attachment processing, or the explot related to webp that was revealed a few months ago. So, yeah, but on ChromeOS, who cares? You can reset it easily and your files are stored on Google servers, anyway. Use 2FA for your account and if you’re not a high profile target, it’s unlikely anyone will try that hard.