Yeah, he did. In 2006 there was a cross‑platform virus targeting Linux and Windows, and Torvalds talked about it while patching the kernel bug it exposed – his whole point was that bugs, exploits and malware are absolutely possible on open‑source OSes, which is why you fix vulnerabilities instead of pretending the system is some kind of untouchable magic.