Fact When it comes to web servers, the biggest target is Apache, the Internet's server of choice.
Sure. Apache is run everywhere. But in OS discussions we are talking about the end user's desktop or laptop, not at the host...though we do see plenty of the effects of them, as well as serverside script hacks, SQL injections, etc., all the time.
I had to leave a host because of these. The morons outsourced all their work to Russia. Brilliant. Right into the belly of the beast.
But the argument is popularity==risk of attack. If that was true, Apache would be more at risk than IIS, but that's not true.
The reality is that Windows is a much easier target than Linux, OSX, xBSD or a proprietary Unix.
If Linux was at the same popularity level as Windows then it would NOT have the same problems because the vast majority of Windows infections are due to design decisions that Microsoft made and have refused to correct.