You could've included a little more nuance. An interpretation of your response is "being the most popular remotely accessible software" != "the most attacked", which would need defending.
Lots of counter examples and definitely no clear relationship. IMO its up to the person making the claim to provide evidence.
The most popular widely deployed software will be the most valuable to attack. That most fail is a function of other properties of the software.