I only remembered a joke:
"Microsoft is not the answer. Microsoft is the question. "No" is the answer!"
(via nixCraft - https://www.facebook.com/nixcraft/photos/a.431194973560553.114666.126000117413375/911435992203113/?type=1&theater)
Windows 2008/R2/2012 has really great defaults (secure by default), automatic updates, everything external disabled by default, and tons of under-the-hood improvements to mitigate unknown vulnerabilities.
With Windows Core the attack surface shrinks even smaller.
In the last few years I cannot think of any automatic malware spreading via Windows Server 2008 or onwards but I can think of several instances where services running on Linux distributions have been impacted to different degrees.
The Linux kernel is definitely ahead of the Windows kernel both in terms of security but also in terms of technology. However the Linux operating system (as in "normal" Linux distributions) are highly inconsistent and many have insecure-by-default configurations (like Apache/PHP/MySQL running out-of-the-box, but often with an insecure PHP and updates not installing for several more days automatically).
I'd say that the statement that Windows Server is more secure than Linux (operating system) is likely more true than it is false. But frankly a lot of people in the Linux space are so arrogant that they don't really take security as seriously as they could. Even with mounting reports of infected Linux servers spreading malware, spam, or being used to launch DDoS attacks.
Are Linux servers as big of a threat as insecure Windows clients? No. No they're not. But that is largely a numbers game, there are maybe 150+ Windows clients for every 1 Linux server. But if we're talking server Vs. server, Linux would likely be the number #1 most commonly infected in 2014.