They are included in most Linux distributions. They aren't Linux, or even part of Linux, at least in terms of who is "responsible". They are maintained by separate teams of developers, and blaming "Linux" would be like blaming Microsoft for a bug in Photoshop.
One could contend that some of them are necessary for Linux to be "useful" and equivalent to Windows. Therefore, it might be fair to include them in an overall comparison to Microsoft.
However, there are also a number of applications that have no direct equivalent on a Windows desktop, and typically don't exist except in enterprise server configurations. Unless your Microsoft patch count includes those types of applications or server software, it wouldn't be a fair comparison.
Start adding on the security patches numbers for applications for the Linux Kernel like PHP and the security swiss cheese Apache and the numbers for Linux get VERY ugly.
Check your list again. They were already included.