Security isn't just about lack of buffer overflows. It's in the way users interact with the system, and the way they're encouraged to interact.

In most Linux distributions, the user is encouraged (by the design of the system) to, in almost all cases, either install cryptographically-signed software packages vetted and maintained by the vendor; or download a source package and compile it themselves. In Windows, the user is encouraged (by the design of the system) to download unsigned binaries from all over the Web and run them.

That's why I'll never consider Windows to be comparably secure to modern Linux distributions. Sure, you can keep a Windows system airtight, but the way the system is designed makes it require effort, so users, in general, don't.