<p><pre><code>   &gt; No matter what OS you choose it is vulnerable to
   &gt; viruses.
</code></pre>
It is a bit more nuanced than that. While it is true that absolute security is generally deemed impossible, if you use a widely deployed operating system in your device there are both a number of actors trying to compromise it for different reasons, and a number of examples that can be acquired for testing different exploits.<p>By writing just enough &quot;OS&quot; to achieve your goals in an embedded system, and then designing a clean access API through which you cannot affect the underlying code (no &quot;here download this new firmware&quot; call) you can avoid that particular threat vector.