it's really easy to find vulnerabilities on it, like the PIT.BIN exploit and unlaunch's boot code exploit
Even if your security is horrendous by today's standards it still requires a certain level of understanding and careful study to uncover flaws. There is no such thing as an "easy vulnerability" when we're talking about (publicly) undocumented internals.
i guess here it's not an bullshit anymore.... because to install homebrew apps it's not easy as expected you need Unlaunch's patches or an CFW, but thanks to nocash and @Pk11 is possible install DSi Titles on the DSi Menu (only with unlaucnh patches) that's my opinion on the DSi OS
It sounds a lot to me like you are judging solely based on user experience provided to you by people who have already split the security wide open without yourself having an understanding of how it actually works.
because it doesn't have an kernel on it
And...? It's a game console with a tight ecosystem, from almost two decades ago (cheap, battery-limited, thermally-constrained mobile chips in 2008 were... less advanced! crazy concept right), and this was only right at the start of when everything was trying to be the home media center or PDA replacement, so I don't think it was too unreasonable that Nintendo did not want to develop an elaborate operating system beyond the bare requirement to delay piracy.
A lot of basic security common at the supervisor level is dependent on a hardware implementation to remain reliable and performant. This is portable hardware, intended to be cheap too, so you can imagine what corners had to be cut... (i could not find information on if the DSi had a hardware MMU, some ARM9 CPUs embed one but not all). You have to remember the Game Boy Advance was even more primitive software-side and even lacked good dedicated sound hardware as late as 2001 (mixing was CPU driven). More powerful home consoles which arguably had no excuse were pretty behind in software security too until the 7th generation when online play became a common focal point. This sort of thing was expected.
Home computers before Y2K primarily ran systems not built for security either, and they were WAY more wide open for attacks than
any game console post-2600 would be. At that time, Windows users still had not moved to NT yet, this was pre NeXT-MacOS merge so MacOS was total horse shit, and if you had an Amiga still you were running everything in the kernel.
So, for a much less powerful handheld released only the next decade to not have cutting edge security is not that crazy. This isn't for lack of trying, Nintendo had a dedicated "DS mode" to close off previously discovered entry points.
The truth is that before the 2010s when everyone decided they wanted to be a chronically online esports celebrity, a game developer did not care what security existed on a console, only the publisher and Nintendo's licensing team, and only because it affected their sales. Think of it from Nintendo's perspective: you probably weren't getting your bank details stolen from a DS of all things (this kind of poor foresight ended up with a New Leaf hack later on the 3DS that was actually used for this but that's a story for another day). In hindsight this was all a ticking time bomb but when you consider the historical context Nintendo did a relatively typical job for the time.