Linux has more security bugs because it's a tangled mess of spaghetti code, large sections of which aren't particularly well maintained.
Seriously, try looking for dangling pointer bugs, there's tons, you can just pluck them from the trees.
Here's a comment I posted a while back that might be of interest: http://news.ycombinator.com/item?id=2301830