It definitely is the most popular OS for security peeps, however those VMs mentioned in the article are purpose built to be vulnerable. They allow someone to spin them up and attempt to hack the boxes (likely using Kali) as a way of honing their offensive security skills.
another way is to increase defensive skills by starting with Damn Vulnerable Linus (DVL) and trying to close all holes and having someone try to crack it.
