While it's possible that Java just hasn't been as much of a target, the difference between Windows and IE (which are the two M$ products that particularly got them into trouble with security flaws) and Java's JVM, other than one being an OS, one being a browser, and the other being a runtime environment, is that the former two started off being buggy and got better, and the JVM has been in the news for more security problems since Oracle took over. I think the finger to point is at Oracle. From what I have heard about how things went when they were taking over, I think the issue is that they are too "enterprise" for their own good. Sun's lawyers were pretty awful (or too good depending on whether you like suing) too though, so maybe some was inherited.

One other thing before I go- are other JVM languages affected by these bugs?