I wonder if that might have been due to Windows market share? Windows was everywhere on the desktop, and those Windows desktops provide a good intermediary vector for attacking instances of IIS on Windows Servers.

Also, thinking back to the bad old days and the script-kiddie-eseque of many viruses of the early 2000s (iloveyou, et al), I suspect it may come down to attacking what you know: Windows was more prevalent and better understood so that's what people tried to break.

Not my field though, so all just speculation.