Read more from SecurityFocus:
For instance, applications for Linux and BSD are often grouped in as subcomponents with the operating systems that they are shipped with. For Windows, applications and subcomponents such as Explorer often have their own packages that are considered vulnerable or not vulnerable outside of Windows and therefore may not be included in the count. This may skew numbers [big time].Considering the vast number of Explorer, Outlook and IIS vulnerabilities that were out, the Windows number should have been quite higher, but they weren't counted. This also doesn't take into consideration that Windows enables most services and installs almost all packages by default, while usual Linux practice is to install only those packages and services that are needed, which for any one installation reduces the vulnerability count.