Secunia doesn’t list Vista as having any unpatched vulnerabilities. Of the unpatched Mac vulnerabilities, none involve system access (only DoS and privilege escalation). These contests involve fully patched and protected machines, not out-of-the-box installations.
I’d suspect the choice of which to attack depends on the Linux build they’re offering. If the attacker can select, I’d guess they’d go with an easier target like Red Hat.
Secunia is missing at least two that I’m aware of. Why? Because two of my users with “fully patched” Vista laptops came back from a convention with pwned laptops.
Secunia is not a completely trustworthy source IMHO.
They’re a bit too marketing and pr driven.