If you want to say a full redhat install with all packages has more bugs than just MS windows on its own, fine but that is verbalizing the weakness in the study, printing a graph and leaving out the weaknesses in methodology in the study where the graph came from is pretty lame, and very dceptive. After all Oracle a closed source company would have led the list if they went by security vulnerabilities but was not even on the list by vendor listed updates.
A better comparison would be Equivalent systems a windows desktop vs a Linux desktop (that would be no apache, no bind, no ldap server, ....) even then there is the issue of what do we count vendor patches or the number of bugs they address? and then there is always the fact OSS bugs get reported far more easily than those of closed source companies like MS and Oracle..
But I'm a dim user of Linux. I installed everything to be cool. So am I vulnerable or not? Just like so many dim users of windows install everything. But that's M$ fault when users do dim things. When dim users do stupid things with Linux it's the users fault.
I see how this works. Spin, Spin, Spin...