My actual experience of post release vulnerability patching is that Desktop Linux will provide the required update in a timely manner and it will be installed transparently through system update. The user often doesn't even notice there was a vulnerability in the first place. On par with windows update though a bit less intrusive and annoying.

Linux Desktop is not secure by default for the same reason Secure Linux does not offer the best desktop experience: more secure means less convenient. Desktop Linux aims at being convenient.

Also keep in mind, we are comparing a single Microsoft OS to a variety of Linux distros each with its own default. it would make more sense to compare all of those individually to see how they fit to a couple standard threat models. Then put them through a week of everyday use by a not knowing better user and see how much damage the different OS sustain.