The days when you could blame Windows for being more insecure than other OSes are long, long gone. That hasn't been the case for probably at least a decade at this point.
While there are numerous ideas on what the "right way" to do IT might look like, no one has reconciled that with the economics of current business practices.
One clear area is that Windows has very weak separation of admin from user. There are tons of great mechanisms like integrity levels, but for a user's laptop Microsoft does not consider UAC to be a boundary between user and Admin and so escalations are ubiquitous.
This is certainly not the case with OSX and Linux.
Windows also has a litany of persistence mechanisms, far more than I'm aware of with OSX and Linux. The Windows registry is this incredible hive of ways to execute code.
There's all sorts of debt involved that really puts Windows at a disadvantage, despite their significant investments that we should all celebrate.
Once you add things like Word, Active Directory, etc, it gets really bad. If you're building a traditional "microsoft" network you're setting yourself up for ransomware.
All systems have varying degrees of vulnerability but only Windows lends itself to automating them to such an astonishing degree.