A valid point - you can't match Microsoft's resources and in-house expertise.

But you are probably a much less appealing target. Also, you might be willing to lock it down more than Microsoft, which has to please all those millions of customers and wants to admin it at the lowest cost possible - including possibly minimizing support calls by using permissive settings - and not with the most security possible.