Any operating system is swiss cheese if it isn't understood by the people who maintain it. The Windows NT operating system had a wonderful beginning, but was not written for security. Then it was bludgeoned and compromised in the mid-90's to make it more user-friendly and responsive, and Microsoft started losing track of what was actually going on inside it. By the time Vista came out, it was wildly out of control, and in the mass exodus of top engineering people when Vista shipped, one was quoted as saying "Nobody at Microsoft really understands how Windows works any more".
That same NT codebase is what is running Win7, Win8, and Win10. Granted, it's much improved through those iterations (we're talking the underlying codebase of the operating system, not the GUI). But it's still a mystery to everyone outside Microsoft, and most of those inside.
Mac software suffers from the same proprietary nature, but it's built over open-source UNIX which is solid and secure. Linux is probably in the best shape in these regards. But every operating system has bugs, and they all need patches.
My personal hope is that that someday, Microsoft chucks out the albatross of the NT codebase and migrates their systems to something that is intrinsically more secure and stable by design. Hell, they could do what Apple did, use UNIX as the base and run their GUI and userland stuff on it. Windows could make a quantum leap that way, IMO.
I really want Microsoft to succeed by improving Windows, and I personally think that is best done with a total revamping of the architectural structure. They've got a lot of brilliant people there. They could do it if they wanted to. I'm not holding my breath, though.
Unfortunately, if they do, the primary motivation will be to build in even more (and more intrusive) spyware and malware, and getting that to work will be Job 1. If they do happen to improve the architecture from a security (from others than them and the NSA) standpoint, it would be only an afterthought with minimal quality control (and may even be impossible to do well as it might then pose difficulties for their own spyware).