Also, there is selection bias at work here: we don't hear about all the stuff that the Microsoft fuzzing team does find. And I bet it's a lot. There's no real benefit to them to share their internal findings - it would effectively just be handing 0-days to malware authors on a plate, after all, affecting all users running older versions - and so we get this very skewed view.