I was the tech director for Bernie 2016, and this part tripped my bullshit meter as well. The VAN is a SaaS, not an on-premise solution. The DNC has some servers that have tight integrations with VAN (e.g. direct db access as opposed to using the API) but saying they had "NGP VAN software installed on their system" is a stretch at best, and those certainly aren't the same servers that the DNC uses to store their oppo research and such.
NGP-VAN does run on Azure though, FWIW. I don't know what OS the DNC's servers run on, but it wouldn't shock me if it was Windows as well.
If I had to guess, this whole part is a red herring. I'm sure either guccifer social-engineered folks at the DNC and/or the DNC was storing their oppo research on old servers with shitty security. The NGP VAN was an easy name to throw out and divert attention since their own security issues have been well-publicized in the past.